diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index 4c0118e2..3127fabd 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -85,7 +85,7 @@ resource "example_resource" "this" {
 | <a name="input_available_actions"></a> [available\_actions](#input\_available\_actions) | List of action template names to fetch from the service spec repository | `list(string)` | `[]` | no |
 | <a name="input_available_links"></a> [available\_links](#input\_available\_links) | List of link template names to fetch from the service spec repository | `list(string)` | <pre>[<br/>  "connect"<br/>]</pre> | no |
 | <a name="input_bitbucket_email"></a> [bitbucket\_email](#input\_bitbucket\_email) | Bitbucket account email, used only when git\_provider = "bitbucket". Set it when repository\_token is an Atlassian API token: those authenticate ONLY via HTTP Basic "email:api\_token" and return 401 with a Bearer header. Leave null when repository\_token is a Bitbucket workspace/repository access token, which is sent as a Bearer token. | `string` | `null` | no |
-| <a name="input_dimensions"></a> [dimensions](#input\_dimensions) | Key-value pairs for dimensions to be associated with the service specification | `map(string)` | `{}` | no |
+| <a name="input_dimensions"></a> [dimensions](#input\_dimensions) | Dimensions for the service specification, used when the spec template does not declare its own. The API accepts both a map of values and the required-flag form, e.g. {"environment": {"required": true}}, so this is intentionally untyped. | `any` | `{}` | no |
 | <a name="input_extra_visibile_to_nrns"></a> [extra\_visibile\_to\_nrns](#input\_extra\_visibile\_to\_nrns) | Additional NRNs that should have visibility to the created service specification | `list(string)` | `[]` | no |
 | <a name="input_git_provider"></a> [git\_provider](#input\_git\_provider) | Git provider to fetch service specs from. Supported values: "github", "gitlab", "bitbucket", "local". | `string` | `"github"` | no |
 | <a name="input_gitlab_host"></a> [gitlab\_host](#input\_gitlab\_host) | GitLab host. Only used when git\_provider = "gitlab". Override for self-hosted instances (e.g. "gitlab.mycompany.com"). | `string` | `"gitlab.com"` | no |
diff --git a/nullplatform/service_definition/locals.tf b/nullplatform/service_definition/locals.tf
index 9a3dcdea..389f0da5 100644
--- a/nullplatform/service_definition/locals.tf
+++ b/nullplatform/service_definition/locals.tf
@@ -49,6 +49,9 @@ locals {
     jsondecode(data.http.service_spec_template[0].response_body)
   )
 
+  template_dimensions  = try(local.service_spec_parsed.dimensions, {})
+  effective_dimensions = length(local.template_dimensions) > 0 ? local.template_dimensions : var.dimensions
+
   available_actions = var.available_actions
   available_links   = var.available_links
   visible_to_nrns   = concat([var.nrn], var.extra_visibile_to_nrns)
diff --git a/nullplatform/service_definition/main.tf b/nullplatform/service_definition/main.tf
index b0696d77..e9a8e0cf 100644
--- a/nullplatform/service_definition/main.tf
+++ b/nullplatform/service_definition/main.tf
@@ -11,7 +11,7 @@ resource "nullplatform_service_specification" "from_template" {
     provider     = local.service_spec_parsed.selectors.provider
     sub_category = local.service_spec_parsed.selectors.sub_category
   }
-  dimensions = jsonencode(var.dimensions)
+  dimensions = jsonencode(local.effective_dimensions)
 }
 
 resource "nullplatform_action_specification" "from_templates" {
diff --git a/nullplatform/service_definition/variables.tf b/nullplatform/service_definition/variables.tf
index e8afd76b..3fca5354 100644
--- a/nullplatform/service_definition/variables.tf
+++ b/nullplatform/service_definition/variables.tf
@@ -39,11 +39,16 @@ variable "repository_branch" {
     points at is its own choice, so there is no version anyone could pick for it.
 
     Combine with repository_ref_type, which selects the namespace this name lives in.
+
+    Not read when git_provider = "local": specs come from local_specs_path and no
+    spec repository is fetched, so the pinned-ref rule below does not apply there.
   EOT
 
   validation {
-    condition     = var.repository_branch != "" && !contains(["main", "master", "head", "latest"], lower(var.repository_branch))
-    error_message = "repository_branch must be a non-empty pinned ref, not empty and not a moving branch."
+    condition = var.git_provider == "local" || (
+      var.repository_branch != "" && !contains(["main", "master", "head", "latest"], lower(var.repository_branch))
+    )
+    error_message = "repository_branch must be a non-empty pinned ref, not empty and not a moving branch. Only git_provider = \"local\" is exempt, since it reads no spec repository."
   }
 }
 
@@ -95,9 +100,9 @@ variable "extra_visibile_to_nrns" {
 }
 
 variable "dimensions" {
-  type        = map(string)
+  type        = any
   default     = {}
-  description = "Key-value pairs for dimensions to be associated with the service specification"
+  description = "Dimensions for the service specification, used when the spec template does not declare its own. The API accepts both a map of values and the required-flag form, e.g. {\"environment\": {\"required\": true}}, so this is intentionally untyped."
 }
 
 variable "repository_ref_type" {