diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index 2c83804..f1bbe15 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -4,14 +4,14 @@ schema_version: 1
 bundle:
   version: "0.9.7-dev"
   release_sequence: 0
-  source_tree_digest: "sha256:17341c00e8252e7d0cd59eebc1fcecaf28301796285a2ae632da75c8932532d0"
-  digest: "sha256:2e8396d66b4365235b9a262a3f9fe66cd727d410ee121cb4e6a218c5e4a49719"
+  source_tree_digest: "sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874"
+  digest: "sha256:b1eb23b12eaa04e622fbe81f873aca00815c85d154d28f1e8faa7e21b11c0052"
 
 projection:
-  input_digest: "sha256:4b96ba6416faa4ce8f3ecf4642f142dfabb1a4fb65d8a34962bb00b94296700d"
-  output_digest: "sha256:3c98bb2cbe91041ea84b336ebc48f361409c7d796795affd6a0b4d27ff28e843"
+  input_digest: "sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00"
+  output_digest: "sha256:f45b937412136b0e07ca680f9d4a3e9c2c1d50b1b1d50c443a1876920f9fbda2"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:9f498788bdc34e52a0ab793c536e0e6a7b360c2e1a20446cbf03ed51986cdc6f"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:8fb50e6d5ea61d144d10c38f555a034646968d5537b811de4412f00cc5a958e3"
+      digest: "sha256:1ed96da28022277030c59cd799b647f267e437ca717406bdf2891b88bceeba82"
diff --git a/.gds/repository.yaml b/.gds/repository.yaml
index 2184137..f64a805 100644
--- a/.gds/repository.yaml
+++ b/.gds/repository.yaml
@@ -81,7 +81,7 @@ ci:
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.
diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml
index 0616c98..84e6287 100644
--- a/.github/workflows/ci-feedback-events.yml
+++ b/.github/workflows/ci-feedback-events.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       actions: read # Read exact completed run and job metadata.
       issues: write # Publish bounded failure evidence in this repository.
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@9f100310e1cdda6e387353671b3a57e6f5897098 # commit:9f100310e1cdda6e387353671b3a57e6f5897098
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@37a827f921f62353664fc4bcd872f05b65efe71a # commit:37a827f921f62353664fc4bcd872f05b65efe71a
     with:
       run-id: ${{ format('{0}', github.event.workflow_run.id) }}
       run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4dee195..61b4c88 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@37a827f921f62353664fc4bcd872f05b65efe71a # 0.1.24
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index 277cf32..2a31908 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.9.7-dev
-# source-tree-digest: sha256:17341c00e8252e7d0cd59eebc1fcecaf28301796285a2ae632da75c8932532d0
-# input-digest: sha256:4b96ba6416faa4ce8f3ecf4642f142dfabb1a4fb65d8a34962bb00b94296700d
-# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38
+# source-tree-digest: sha256:fe02c4580c0096f44bee9a34ddfba300a60e63825a4e95f31ccc5bb15dc71874
+# input-digest: sha256:7b89757f969d6a784ddf171c26f0ce346290d5358cb3d1a38cec0f8e2b6e8d00
+# output-digest: sha256:34152d66b8aec3c2352b91347df0196dc94749ccb4cf4c5357ccef1373217d71
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,7 +34,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -54,7 +54,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
index 7d3b258..7744078 100644
--- a/tests/golden/projections/control-plane/.claude/CLAUDE.md
+++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.9.7-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8
+input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml
diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
index 3ffa6db..a681a53 100644
--- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
+++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -8,14 +8,14 @@ bundle:
   digest: "sha256:fe686e5956e8cd0e9904ebdbf70a5abd14998e3ae04993781fcb93e48a09e6ab"
 
 projection:
-  input_digest: "sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8"
-  output_digest: "sha256:cd1bc0444d6f250dda92bf1d498c354c0319a3713c40f74349bb493f7a35c54f"
+  input_digest: "sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5"
+  output_digest: "sha256:50c6c720957993d85558daf56607fd6820f3905320aa1ceffffa6f8165632af7"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:44191b6f7a597c0257fda7cc4b813ecc21810d4d8b03d0ecdee985b4cbffe729"
+      digest: "sha256:8d08803273369641ef0a9bdcc30dfdde53ebe56ccc29f15a2fcae7721101a0cd"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:f86f7e2eb77664de1960f9dd25835b4e7341ce02378803df34372c50c94c86fb"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:a751158efad9987a1524e7f85436d39af07a1fd94f8308013b46ff4ab053e657"
+      digest: "sha256:00d0d9e580d5c6a390a37927a8565872de4f72894b6c67c5be87033c5b4aebde"
     - path: "AGENTS.md"
-      digest: "sha256:9553b54acaa8f11027433ef79c339c1c14e90877a1a402bf8be7ed65dbdcedac"
+      digest: "sha256:e0d0005904383162ea4e51b9e127a917263a38234eba8fa761251bcfd6ba38a4"
diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
index 05f9726..5b7811a 100644
--- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
+++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -2,8 +2,8 @@
 # generator: gds
 # bundle: 0.9.7-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8
-# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38
+# input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5
+# output-digest: sha256:34152d66b8aec3c2352b91347df0196dc94749ccb4cf4c5357ccef1373217d71
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -53,7 +53,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@37a827f921f62353664fc4bcd872f05b65efe71a
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
index c231431..abf4c1a 100644
--- a/tests/golden/projections/control-plane/AGENTS.md
+++ b/tests/golden/projections/control-plane/AGENTS.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.9.7-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:4eefca123b3b75f390ee5794f5ba1ec518777a267aeb5bce7bc0bf4fd9fe21f8
+input-digest: sha256:48b0c21cd064d41f2cab44bd6d3e90ede9b6ce13225cfdbed48e879f76938de5
 output-digest: sha256:c9674389b139e2ea844844d3e0bb9227a1528f4a5af9347e5dd43c563f8e1bd4
 edit-source:
   - .gds/repository.yaml