diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index 8601472..8825401 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -5,14 +5,14 @@ bundle:
   version: "0.8.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:6a2841ed1461b416ed9e3c393f5e7bd09cad1910ca4a99ed141aa55961860b0f"
-  digest: "sha256:d238ecef552753c9e73f67daf6efc4b7784198e6115463b1745429d43c1b1930"
+  source_tree_digest: "sha256:d76906627f908b796164bf3070579800f5087462335823f6524ff918862e991a"
+  digest: "sha256:71793f34bbb38088800964c34a2c2a0f0ba02a0b725620db9d370c81ff4a9496"
 
 projection:
-  input_digest: "sha256:7f1cedba841019882c248c7a6fbd70894d86745bba56853f9fcd298994253f06"
-  output_digest: "sha256:6957de5ca56f78ea1b18802a04e3ef25f53558025ef64292f4329bff8731601c"
+  input_digest: "sha256:5b4f5697a87f13d38bedc7ae5b37a36de65b08c2cd4986358f526f90cb005e04"
+  output_digest: "sha256:186592ce7518765ffa6c604a16740c827ad8f6ce1f0eb6aa4f6822dafe028321"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:807282f820294914e1c7e6ad1bf27c54a799d56305c58630254ab50ab286f379"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:9356f7db1950f27c280da32e72588d78f3fcbfa8224cdb2690d752bc53b61c0c"
+      digest: "sha256:28e93787aeee67af6e43b237224ec5444ea01dcf7e87079cf910d7acc2de225e"
diff --git a/.gds/repository.yaml b/.gds/repository.yaml
index 50c00d9..54891ce 100644
--- a/.gds/repository.yaml
+++ b/.gds/repository.yaml
@@ -81,7 +81,7 @@ ci:
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e1ad91d..9c0689e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5 # 0.1.15
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@bc9c7919de1c39d947a8709a92856925051bae05 # commit:bc9c7919de1c39d947a8709a92856925051bae05
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index 18a8f59..b9bf022 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.8.0-dev
-# source-tree-digest: sha256:6a2841ed1461b416ed9e3c393f5e7bd09cad1910ca4a99ed141aa55961860b0f
-# input-digest: sha256:7f1cedba841019882c248c7a6fbd70894d86745bba56853f9fcd298994253f06
-# output-digest: sha256:a911ec3d1d5728bbe37fec78e04cc8452b9dbb1e8b394d0b8cace067804eff9a
+# source-tree-digest: sha256:d76906627f908b796164bf3070579800f5087462335823f6524ff918862e991a
+# input-digest: sha256:5b4f5697a87f13d38bedc7ae5b37a36de65b08c2cd4986358f526f90cb005e04
+# output-digest: sha256:8c045e745cc69b731bc695a4a9d58a48c10f1ab7dd85b7354db7bfd0e072711c
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -34,7 +34,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -54,7 +54,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
index 42bd577..8f5df51 100644
--- a/tests/golden/projections/control-plane/.claude/CLAUDE.md
+++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
+input-digest: sha256:e84c2faf42161d5add82c4bc06c3eee103666c005a0a5aceb0b65c847d6540b3
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml
diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
index bbd11e2..153cf6c 100644
--- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
+++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -9,14 +9,14 @@ bundle:
   digest: "sha256:620a284abd424fa8e2d34d77447d2435f300b6c3c69016f447fbe479b5db655f"
 
 projection:
-  input_digest: "sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8"
-  output_digest: "sha256:e908b4adc5bdd3b1083958a9dad4732811919e74da23bb862d4a152ecb490151"
+  input_digest: "sha256:e84c2faf42161d5add82c4bc06c3eee103666c005a0a5aceb0b65c847d6540b3"
+  output_digest: "sha256:bb74d9a03b3bc47b4d64a5fe867411a5f6169df675dac966bde4bbb30da20432"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:6c13e455efb696aa54024defeeb3700d70683e759014f9d749cf16b6b54b28a9"
+      digest: "sha256:366c3a922c8ffbd400cbe9d20fc90b406f48297e8587dfbab065c283bcb72a50"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:24850d3c840160a5bef16753424da983b1e220984e2457fd22ee03ed278f1f1b"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:320e4436a13c228c5260695cda0aa528e9757534b3b0336e2283e262124be1dc"
+      digest: "sha256:53508157fc79a84cd4dff76f4842ff87c63fd166f6e8c21f58f71c51bba8494e"
     - path: "AGENTS.md"
-      digest: "sha256:4814e714012fbeadcaada7d9121e4363f16c32e702e8949ee05eea26dde8e9d9"
+      digest: "sha256:51fb1fdab45861132eeedaa45d5f63acc499cac525362308946c6d60cd746e91"
diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
index 2741805..ca9f839 100644
--- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
+++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -2,8 +2,8 @@
 # generator: gds
 # bundle: 0.8.0-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
-# output-digest: sha256:a911ec3d1d5728bbe37fec78e04cc8452b9dbb1e8b394d0b8cace067804eff9a
+# input-digest: sha256:e84c2faf42161d5add82c4bc06c3eee103666c005a0a5aceb0b65c847d6540b3
+# output-digest: sha256:8c045e745cc69b731bc695a4a9d58a48c10f1ab7dd85b7354db7bfd0e072711c
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -53,7 +53,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@706233fdc953d4281389c0fd5f8c1a007e19a1f5
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@bc9c7919de1c39d947a8709a92856925051bae05
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
index 9745db8..18a713b 100644
--- a/tests/golden/projections/control-plane/AGENTS.md
+++ b/tests/golden/projections/control-plane/AGENTS.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:1d6bdbba745ef7f1d231358b76744f6bb87db8dd9af238905b9a6baab01d51a8
+input-digest: sha256:e84c2faf42161d5add82c4bc06c3eee103666c005a0a5aceb0b65c847d6540b3
 output-digest: sha256:e068119ce6b21b80367eaaeefdb3821e19e8cc2cb9d6613fe020c547ef0892d8
 edit-source:
   - .gds/repository.yaml