diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45892b5b..054a93c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [7.8.0](https://github.com/nullplatform/tofu-modules/compare/v7.7.0...v7.8.0) (2026-09-11)
+
+
+### Features
+
+* **eks:** pin the cluster addon versions with addon_versions ([#581](https://github.com/nullplatform/tofu-modules/issues/581)) ([ee87a05](https://github.com/nullplatform/tofu-modules/commit/ee87a051edc39fa6201a5723f66d7e31e165662b))
+
 ## [7.7.0](https://github.com/nullplatform/tofu-modules/compare/v7.6.0...v7.7.0) (2026-09-09)
 
 
diff --git a/VERSIONS.md b/VERSIONS.md
index c2f1b57e..ba58e6b1 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -14,20 +14,20 @@ a specific release, so an upgrade is something someone decides.
 
 ## What to pin
 
-Verified 2026-09-08.
+Verified 2026-09-11.
 
 | Component | Current | Variable | Module |
 | --- | --- | --- | --- |
 | `nullplatform-base` chart | `2.44.6` | `nullplatform_base_helm_version` | `nullplatform/base` |
 | `nullplatform-agent` chart | `3.0.0` | `nullplatform_agent_helm_version` | `nullplatform/agent` |
-| `cert-manager` chart | `v1.21.1` | `cert_manager_version` | `infrastructure/commons/cert_manager` |
-| `prometheus` chart | `29.27.2` | `prometheus_version` | `infrastructure/commons/prometheus` |
+| `cert-manager` chart | `v1.21.2` | `cert_manager_version` | `infrastructure/commons/cert_manager` |
+| `prometheus` chart | `29.28.1` | `prometheus_version` | `infrastructure/commons/prometheus` |
 | `istio-base` chart | `1.30.4` | `istio_base_version` | `infrastructure/commons/istio` |
 | `istiod` chart | `1.30.4` | `istiod_version` | `infrastructure/commons/istio` |
 | `gateway-api` CRDs | `v1.5.1` | `gateway_api_crd_ref` | `nullplatform/base` |
 | `k8s-logs-controller` | `1.6.1` | `logging_controller_image_tag` | `nullplatform/base` |
-| `k8s-traffic-manager` | `1.8.0` | `agent_traffic_manager_tag` | `nullplatform/agent` |
-| traffic manager (provider config) | `1.8.0` | `traffic_manager_version` | `container_orchestration/eks` |
+| `k8s-traffic-manager` | `1.8.1` | `agent_traffic_manager_tag` | `nullplatform/agent` |
+| traffic manager (provider config) | `1.8.1` | `traffic_manager_version` | `container_orchestration/eks` |
 | `scopes` repository | `v1.15.1` | `agent_repo` (as `"https://github.com/nullplatform/scopes.git#v1.15.1"`) | `nullplatform/agent` |
 
 **Read your cluster before copying these.** The rule is to pin what you are already running,
@@ -48,7 +48,7 @@ module "agent" {
   nullplatform_agent_helm_version = "3.0.0"
   image_tag                       = "0.9.2"
   agent_repos_scope_tag           = "v1.15.1"
-  agent_traffic_manager_tag       = "1.8.0"
+  agent_traffic_manager_tag       = "1.8.1"
 
   agent_repos_extra = [
     "https://github.com/nullplatform/scopes-lambda.git#v0.3.1",
@@ -58,15 +58,15 @@ module "agent" {
 
 # eks, aks and gke all take this
 module "container_orchestration" {
-  traffic_manager_version = "1.8.0"
+  traffic_manager_version = "1.8.1"
 }
 
 module "cert_manager" {
-  cert_manager_version = "v1.21.1"
+  cert_manager_version = "v1.21.2"
 }
 
 module "prometheus" {
-  prometheus_version = "29.27.2"
+  prometheus_version = "29.28.1"
 }
 
 module "istio" {
diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md
index 392e8258..47318437 100644
--- a/infrastructure/aws/acm/README.md
+++ b/infrastructure/aws/acm/README.md
@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"
diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md
index a999408b..44819ddd 100644
--- a/infrastructure/aws/aws_load_balancer_controller/README.md
+++ b/infrastructure/aws/aws_load_balancer_controller/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"
diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md
index d174f43e..8454b879 100644
--- a/infrastructure/aws/backend/README.md
+++ b/infrastructure/aws/backend/README.md
@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.8.0"
 }
 ```
 
diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md
index 0ec27e0e..b4e84738 100644
--- a/infrastructure/aws/dns/README.md
+++ b/infrastructure/aws/dns/README.md
@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"
diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
index 346d2cf8..086164a2 100644
--- a/infrastructure/aws/eks/README.md
+++ b/infrastructure/aws/eks/README.md
@@ -2,27 +2,27 @@
 
 ## Description
 
-Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core add-ons, IRSA, and an EBS CSI driver IAM role using the terraform-aws-modules/eks module
+Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core addons, IRSA, and optional KMS encryption using the terraform-aws-modules/eks/aws upstream module
 
 ## Architecture
 
-The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cluster), optionally provisioning either an EKS managed node group or Auto Mode compute config based on the use_auto_mode flag. An aws_iam_role (ebs_csi_driver) is created and wired into the aws-ebs-csi-driver add-on via service_account_role_arn, while IRSA is enabled to expose an OIDC provider ARN as output. Security group additional rules for NLB health checks and HTTPS ingress are conditionally injected via security_group_additional_rules, using the VPC CIDR fetched from the aws_vpc data source combined with any additional_network_cidrs.
+The module wraps `terraform-aws-modules/eks/aws` (which internally creates `aws_eks_cluster`, `aws_eks_node_group`, `aws_iam_role`, `aws_iam_role_policy_attachment`, and `aws_eks_addon` resources) and wires a locally created `aws_iam_role` for the EBS CSI driver into the addon's `service_account_role_arn`. An `aws_vpc` data source resolves the VPC CIDR for security group rules, which are conditionally added to the cluster security group for NLB health checks and HTTPS ingress. KMS key creation is derived from `encryption_config.provider_key_arn`: when a CMK ARN is supplied the module sets `create_kms_key = false` and passes the ARN through; otherwise the upstream module auto-generates an `aws_kms_key`. When `use_auto_mode = true`, `eks_managed_node_groups` is set to empty and `compute_config` enables EKS Auto Mode with the specified node pools.
 
 ## Features
 
-- Creates EKS cluster with configurable Kubernetes version and dual endpoint access control
-- Provisions EKS managed node group with configurable AMI type, instance type, and scaling parameters
-- Enables EKS Auto Mode with configurable node pools (general-purpose and/or system) as an alternative to managed node groups
-- Installs core EKS add-ons: aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, and vpc-cni
-- Creates IAM role for the EBS CSI driver and wires it to the add-on via IRSA with OIDC provider
-- Configures optional CloudWatch log group for EKS control plane logs with configurable retention
-- Adds conditional security group rules for NLB health checks (port 15021) and HTTPS (port 443) ingress from VPC and peered CIDRs
+- Creates EKS cluster with configurable Kubernetes version and private subnet placement
+- Installs five core addons (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni) with optional version pinning to prevent plan drift
+- Supports EKS Auto Mode with configurable node pools (general-purpose, system) as an alternative to managed node groups
+- Configures IRSA via OIDC provider and creates a dedicated IAM role for the EBS CSI driver
+- Manages KMS encryption for etcd secrets, supporting both auto-generated keys and bring-your-own CMK
+- Adds optional security group rules for NLB health checks and HTTPS traffic using VPC and additional CIDRs
+- Supports configurable API server endpoint access with public CIDR allowlisting and multiple authentication modes
 
 ## Basic Usage
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.8.0"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"
@@ -75,6 +75,7 @@ resource "example_resource" "this" {
 |------|-------------|------|---------|:--------:|
 | <a name="input_access_entries"></a> [access\_entries](#input\_access\_entries) | Map of access entries for the EKS cluster | <pre>map(object({<br/>    principal_arn     = string<br/>    user_name         = optional(string)<br/>    kubernetes_groups = optional(list(string))<br/>    type              = optional(string)<br/><br/>    policy_associations = optional(map(object({<br/>      policy_arn = string<br/>      access_scope = optional(object({<br/>        type       = optional(string)<br/>        namespaces = optional(list(string))<br/>      }))<br/>    })))<br/>  }))</pre> | `{}` | no |
 | <a name="input_additional_network_cidrs"></a> [additional\_network\_cidrs](#input\_additional\_network\_cidrs) | Additional CIDR blocks to allow in security group rules (e.g., peered VPC, on-premises network). | `list(string)` | `[]` | no |
+| <a name="input_addon_versions"></a> [addon\_versions](#input\_addon\_versions) | Pinned EKS addon versions, keyed by addon name (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni). An addon left out keeps resolving to the most recent version, which surfaces as plan drift whenever AWS publishes a new build. | `map(string)` | `{}` | no |
 | <a name="input_ami_release_version"></a> [ami\_release\_version](#input\_ami\_release\_version) | Pin a specific AMI release version for the managed node group (e.g. "1.34.6-20260415").<br/>When null, the upstream module resolves the AMI based on use\_latest\_ami\_release\_version.<br/>Set this to a fixed value when reproducible AMIs are required (e.g. to avoid plan drift<br/>every time AWS publishes a new optimized AMI). | `string` | `null` | no |
 | <a name="input_ami_type"></a> [ami\_type](#input\_ami\_type) | AMI type to use with the node | `string` | `"AL2023_x86_64_STANDARD"` | no |
 | <a name="input_attach_cluster_primary_security_group"></a> [attach\_cluster\_primary\_security\_group](#input\_attach\_cluster\_primary\_security\_group) | Attach cluster primary security group to node groups | `bool` | `true` | no |
@@ -117,16 +118,16 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "eks",
-  "description": "Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core add-ons, IRSA, and an EBS CSI driver IAM role using the terraform-aws-modules/eks module",
-  "architecture": "The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cluster), optionally provisioning either an EKS managed node group or Auto Mode compute config based on the use_auto_mode flag. An aws_iam_role (ebs_csi_driver) is created and wired into the aws-ebs-csi-driver add-on via service_account_role_arn, while IRSA is enabled to expose an OIDC provider ARN as output. Security group additional rules for NLB health checks and HTTPS ingress are conditionally injected via security_group_additional_rules, using the VPC CIDR fetched from the aws_vpc data source combined with any additional_network_cidrs.",
+  "description": "Provisions an Amazon EKS cluster with managed node groups or Auto Mode, core addons, IRSA, and optional KMS encryption using the terraform-aws-modules/eks/aws upstream module",
+  "architecture": "The module wraps `terraform-aws-modules/eks/aws` (which internally creates `aws_eks_cluster`, `aws_eks_node_group`, `aws_iam_role`, `aws_iam_role_policy_attachment`, and `aws_eks_addon` resources) and wires a locally created `aws_iam_role` for the EBS CSI driver into the addon's `service_account_role_arn`. An `aws_vpc` data source resolves the VPC CIDR for security group rules, which are conditionally added to the cluster security group for NLB health checks and HTTPS ingress. KMS key creation is derived from `encryption_config.provider_key_arn`: when a CMK ARN is supplied the module sets `create_kms_key = false` and passes the ARN through; otherwise the upstream module auto-generates an `aws_kms_key`. When `use_auto_mode = true`, `eks_managed_node_groups` is set to empty and `compute_config` enables EKS Auto Mode with the specified node pools.",
   "features": [
-    "Creates EKS cluster with configurable Kubernetes version and dual endpoint access control",
-    "Provisions EKS managed node group with configurable AMI type, instance type, and scaling parameters",
-    "Enables EKS Auto Mode with configurable node pools (general-purpose and/or system) as an alternative to managed node groups",
-    "Installs core EKS add-ons: aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, and vpc-cni",
-    "Creates IAM role for the EBS CSI driver and wires it to the add-on via IRSA with OIDC provider",
-    "Configures optional CloudWatch log group for EKS control plane logs with configurable retention",
-    "Adds conditional security group rules for NLB health checks (port 15021) and HTTPS (port 443) ingress from VPC and peered CIDRs"
+    "Creates EKS cluster with configurable Kubernetes version and private subnet placement",
+    "Installs five core addons (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni) with optional version pinning to prevent plan drift",
+    "Supports EKS Auto Mode with configurable node pools (general-purpose, system) as an alternative to managed node groups",
+    "Configures IRSA via OIDC provider and creates a dedicated IAM role for the EBS CSI driver",
+    "Manages KMS encryption for etcd secrets, supporting both auto-generated keys and bring-your-own CMK",
+    "Adds optional security group rules for NLB health checks and HTTPS traffic using VPC and additional CIDRs",
+    "Supports configurable API server endpoint access with public CIDR allowlisting and multiple authentication modes"
   ],
   "inputs": [
     {
@@ -159,6 +160,11 @@ resource "example_resource" "this" {
       "description": "Authentication mode for the EKS cluster. Valid values: CONFIG_MAP, API, API_AND_CONFIG_MAP.",
       "required": false
     },
+    {
+      "name": "addon_versions",
+      "description": "Pinned EKS addon versions, keyed by addon name (aws-ebs-csi-driver, coredns, eks-pod-identity-agent, kube-proxy, vpc-cni). An addon left out keeps resolving to the most recent version, which surfaces as plan drift whenever AWS publishes a new build.",
+      "required": false
+    },
     {
       "name": "ami_type",
       "description": "AMI type to use with the node",
@@ -251,7 +257,12 @@ resource "example_resource" "this" {
     },
     {
       "name": "encryption_config",
-      "description": "Encryption config for the EKS control plane (KMS encryption of etcd secrets). Default {} preserves the wrapper's pre-existing behavior: the upstream module auto-creates a KMS key. Set provider_key_arn to bring your own CMK — the wrapper then auto-disables upstream's create_kms_key so the supplied ARN is honored.",
+      "description": "",
+      "required": false
+    },
+    {
+      "name": "aws_profile",
+      "description": "Optional AWS CLI profile used by the kubernetes provider's exec plugin (`aws eks get-token`) to authenticate against the cluster. If empty, the default AWS credential chain (or the AWS_PROFILE environment variable) is used.",
       "required": false
     }
   ],
@@ -265,6 +276,6 @@ resource "example_resource" "this" {
     "eks_cluster_security_group_id",
     "eks_cluster_primary_security_group_id"
   ],
-  "hash": "a20671d0031dc3797531a0a3d823521e"
+  "hash": "3f5872e359ef0f6e03b46a812bac03db"
 }
 END_AI_METADATA -->
diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md
index 6997a686..3258503b 100644
--- a/infrastructure/aws/iam/agent/README.md
+++ b/infrastructure/aws/iam/agent/README.md
@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.8.0"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
index 41521f15..d89dda04 100644
--- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
+++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.8.0"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"
diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
index 57b1b7bf..a3facf8f 100644
--- a/infrastructure/aws/iam/cert_manager/README.md
+++ b/infrastructure/aws/iam/cert_manager/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md
index e721c4a7..24474580 100644
--- a/infrastructure/aws/iam/ci-build-workflow-user/README.md
+++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md
@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md
index ab5d5415..cd653dd4 100644
--- a/infrastructure/aws/iam/cloudwatch/README.md
+++ b/infrastructure/aws/iam/cloudwatch/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md
index d6ed6cff..6f4a3982 100644
--- a/infrastructure/aws/iam/ecr/README.md
+++ b/infrastructure/aws/iam/ecr/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.8.0"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"
diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
index 7ca2324a..0b545a50 100644
--- a/infrastructure/aws/iam/external_dns/README.md
+++ b/infrastructure/aws/iam/external_dns/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md
index 67ff3c6d..03013d6b 100644
--- a/infrastructure/aws/iam/s3/README.md
+++ b/infrastructure/aws/iam/s3/README.md
@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.8.0"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"
diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md
index ce1c0097..0dfcecd2 100644
--- a/infrastructure/aws/ingress/README.md
+++ b/infrastructure/aws/ingress/README.md
@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.8.0"
 
   certificate_arn = "your-certificate-arn"
 }
diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md
index 04951fbd..1f6b8f27 100644
--- a/infrastructure/aws/security/README.md
+++ b/infrastructure/aws/security/README.md
@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md
index fa24b507..dbc922f0 100644
--- a/infrastructure/aws/vpc/README.md
+++ b/infrastructure/aws/vpc/README.md
@@ -21,7 +21,7 @@ The module wraps the terraform-aws-modules/vpc/aws community module to provision
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v7.8.0"
 
   account      = "your-account"
   organization = "your-organization"
diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md
index 6dbfa9ac..a813f44c 100644
--- a/infrastructure/azure/acr/README.md
+++ b/infrastructure/azure/acr/README.md
@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v7.8.0"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"
diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md
index 24048008..76e8599b 100644
--- a/infrastructure/azure/aks/README.md
+++ b/infrastructure/azure/aks/README.md
@@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and wir
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v7.8.0"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"
diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md
index 67ec3cf6..0eacc61f 100644
--- a/infrastructure/azure/aks_route_table/README.md
+++ b/infrastructure/azure/aks_route_table/README.md
@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou
 
 ```hcl
 module "aks_route_table" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v7.8.0"
 
   node_resource_group = "your-node-resource-group"
   subnet_id           = "your-subnet-id"
diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md
index 85bd7f8b..91979e09 100644
--- a/infrastructure/azure/dns/README.md
+++ b/infrastructure/azure/dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v7.8.0"
 
   domain_name         = "your-domain-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md
index ff91cf11..442b25ae 100644
--- a/infrastructure/azure/iam/README.md
+++ b/infrastructure/azure/iam/README.md
@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v7.8.0"
 
   location             = "your-location"
   name                 = "your-name"
diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md
index cc14ec64..9ee1231e 100644
--- a/infrastructure/azure/private_dns/README.md
+++ b/infrastructure/azure/private_dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
 
 ```hcl
 module "private_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v7.8.0"
 
   domain_name           = "your-domain-name"
   resource_group_name   = "your-resource-group-name"
diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md
index 48910f2b..221cdeb1 100644
--- a/infrastructure/azure/resource_group/README.md
+++ b/infrastructure/azure/resource_group/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
 
 ```hcl
 module "resource_group" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v7.8.0"
 
   location            = "your-location"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md
index 1db0a8ae..41b8c102 100644
--- a/infrastructure/azure/security/README.md
+++ b/infrastructure/azure/security/README.md
@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v7.8.0"
 
   cluster_name        = "your-cluster-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
index dbcae059..dc52b8f0 100644
--- a/infrastructure/azure/vnet/README.md
+++ b/infrastructure/azure/vnet/README.md
@@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf
 
 ```hcl
 module "vnet" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v7.8.0"
 
   address_space       = "your-address-space"
   location            = "your-location"
diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md
index 2ee90272..6f27f3fb 100644
--- a/infrastructure/commons/cert_manager/README.md
+++ b/infrastructure/commons/cert_manager/README.md
@@ -22,7 +22,7 @@ Two core helm_release resources are created: cert-manager from charts.jetstack.i
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -36,7 +36,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -52,7 +52,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug              = "your-account-slug"
   azure_client_id           = "your-azure-client-id"  # Required when cloud_provider = "azure"
@@ -71,7 +71,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug           = "your-account-slug"
   cert_manager_version   = "your-cert-manager-version"
@@ -87,7 +87,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug         = "your-account-slug"
   aws_region           = "your-aws-region"  # Required when cloud_provider = "aws"
@@ -103,7 +103,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -120,7 +120,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.8.0"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "fixed semver string"
diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md
index 4e09ab21..1f3bb2fa 100644
--- a/infrastructure/commons/external_dns/README.md
+++ b/infrastructure/commons/external_dns/README.md
@@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   dns_provider_name = "your-dns-provider-name"
   domain_filters    = "your-domain-filters"
@@ -33,7 +33,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   cloudflare_token  = "your-cloudflare-token"  # Required when dns_provider_name = "cloudflare"
   dns_provider_name = "cloudflare"
@@ -45,7 +45,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   aws_iam_role_arn  = "your-aws-iam-role-arn"  # Required when dns_provider_name = "aws"
   aws_identity_mode = "your-aws-identity-mode"  # Required when dns_provider_name = "aws"
@@ -61,7 +61,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   dns_provider_name        = "oci"
   domain_filters           = "your-domain-filters"
@@ -77,7 +77,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure"
@@ -95,7 +95,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure-private-dns"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure-private-dns"
@@ -113,7 +113,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.8.0"
 
   dns_provider_name         = "google"
   domain_filters            = "your-domain-filters"
diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md
index 52688d10..7bc73e9d 100644
--- a/infrastructure/commons/istio/README.md
+++ b/infrastructure/commons/istio/README.md
@@ -21,7 +21,7 @@ The module creates two helm_release resources: istio-base (which installs the Is
 
 ```hcl
 module "istio" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v7.8.0"
 }
 ```
 
diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md
index 84aafb90..0f457ed6 100644
--- a/infrastructure/commons/prometheus/README.md
+++ b/infrastructure/commons/prometheus/README.md
@@ -20,7 +20,7 @@ The module renders a YAML values file via templatefile() in locals.tf, injecting
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.8.0"
 
   prometheus_version = "your-prometheus-version"
 }
@@ -30,7 +30,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.8.0"
 
   prometheus_version = "latest"
 }
@@ -40,7 +40,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.8.0"
 
   prometheus_version = "main"
 }
@@ -50,7 +50,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.8.0"
 
   prometheus_version = "master"
 }
diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md
index 416dde65..e775c0ff 100644
--- a/infrastructure/gcp/artifact-registry/README.md
+++ b/infrastructure/gcp/artifact-registry/README.md
@@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource configured
 
 ```hcl
 module "artifact-registry" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v7.8.0"
 
   location      = "your-location"
   project_id    = "your-project-id"
diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md
index 91a3f4d5..1d226693 100644
--- a/infrastructure/gcp/backend/README.md
+++ b/infrastructure/gcp/backend/README.md
@@ -22,7 +22,7 @@ The module creates a primary google_storage_bucket (tf_state) with a random_id s
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v7.8.0"
 
   project_id = "your-project-id"
 }
diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md
index 6924b8ba..5ae05ee4 100644
--- a/infrastructure/gcp/cloud-dns/README.md
+++ b/infrastructure/gcp/cloud-dns/README.md
@@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC
 
 ```hcl
 module "cloud-dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   project_id  = "your-project-id"
diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md
index 6154ba8d..42174b3e 100644
--- a/infrastructure/gcp/cloud-nat/README.md
+++ b/infrastructure/gcp/cloud-nat/README.md
@@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n
 
 ```hcl
 module "cloud-nat" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v7.8.0"
 
   nat_name    = "your-nat-name"
   network_id  = "your-network-id"
diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md
index 9e0eae14..b5884269 100644
--- a/infrastructure/gcp/gke/README.md
+++ b/infrastructure/gcp/gke/README.md
@@ -22,7 +22,7 @@ The module conditionally creates either a `terraform-google-modules/kubernetes-e
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v7.8.0"
 
   cluster_name      = "your-cluster-name"
   ip_range_pods     = "your-ip-range-pods"
diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md
index bec04a10..4e4d0e88 100644
--- a/infrastructure/gcp/iam/README.md
+++ b/infrastructure/gcp/iam/README.md
@@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v7.8.0"
 
   project_id = "your-project-id"
 }
diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md
index 650f67bf..59fb1976 100644
--- a/infrastructure/gcp/security/README.md
+++ b/infrastructure/gcp/security/README.md
@@ -22,7 +22,7 @@ The module uses data.google_container_cluster to derive the VPC network name and
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v7.8.0"
 
   cluster_name   = "your-cluster-name"
   gcp_project_id = "your-gcp-project-id"
diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md
index bd3d1050..b017a387 100644
--- a/infrastructure/gcp/vpc/README.md
+++ b/infrastructure/gcp/vpc/README.md
@@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v7.8.0"
 
   network_name = "your-network-name"
   project_id   = "your-project-id"
diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md
index 156abb48..fbaa72a1 100644
--- a/infrastructure/oci/backend/README.md
+++ b/infrastructure/oci/backend/README.md
@@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v7.8.0"
 
   compartment_id = "your-compartment-id"
   namespace      = "your-namespace"
diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md
index eac6e6c0..076707df 100644
--- a/infrastructure/oci/dns/README.md
+++ b/infrastructure/oci/dns/README.md
@@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v7.8.0"
 
   compartment_id = "your-compartment-id"
 }
diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md
index 52246cdf..1ae16cd2 100644
--- a/infrastructure/oci/dynamic_groups/README.md
+++ b/infrastructure/oci/dynamic_groups/README.md
@@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting
 
 ```hcl
 module "dynamic_groups" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v7.8.0"
 
   cluster_id      = "your-cluster-id"
   compartment_id  = "your-compartment-id"
diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md
index 5c8bf184..d66bfe41 100644
--- a/infrastructure/oci/oke/README.md
+++ b/infrastructure/oci/oke/README.md
@@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v7.8.0"
 
   api_endpoint_subnet_id = "your-api-endpoint-subnet-id"
   cluster_name           = "your-cluster-name"
diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md
index e5b19b5c..5dbfff93 100644
--- a/infrastructure/oci/vcn/README.md
+++ b/infrastructure/oci/vcn/README.md
@@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets
 
 ```hcl
 module "vcn" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v7.8.0"
 }
 ```
 
diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md
index fca48f27..ec28cd2a 100644
--- a/nullplatform/account/README.md
+++ b/nullplatform/account/README.md
@@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each`
 
 ```hcl
 module "account" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v7.8.0"
 
   nullplatform_accounts = "your-nullplatform-accounts"
 }
diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index e82f0f3c..c9e2c1e5 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -22,7 +22,7 @@ A single helm_release resource named 'agent' deploys the nullplatform-agent char
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.8.0"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -37,7 +37,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.8.0"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -54,7 +54,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.8.0"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -69,7 +69,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.8.0"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -90,7 +90,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.8.0"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md
index 4ce003e2..12b9a262 100644
--- a/nullplatform/api_key/README.md
+++ b/nullplatform/api_key/README.md
@@ -21,7 +21,7 @@ The module defines a single nullplatform_api_key resource whose name, grants, an
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   type = "your-type"
 }
@@ -31,7 +31,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   nrn  = "your-nrn"  # Required when type = "agent"
   type = "agent"
@@ -42,7 +42,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   nrn  = "your-nrn"  # Required when type = "base"
   type = "base"
@@ -53,7 +53,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   nrn                = "your-nrn"  # Required when type = "scope_notification"
   specification_slug = "your-specification-slug"  # Required when type = "scope_notification"
@@ -65,7 +65,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   nrn                = "your-nrn"  # Required when type = "service_notification"
   specification_slug = "your-specification-slug"  # Required when type = "service_notification"
@@ -77,7 +77,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.8.0"
 
   custom_name       = "your-custom-name"  # Required when type = "custom"
   custom_role_slugs = "your-custom-role-slugs"  # Required when type = "custom"
diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md
index 8df56e81..1bfe9c4c 100644
--- a/nullplatform/asset/docker_server/README.md
+++ b/nullplatform/asset/docker_server/README.md
@@ -20,7 +20,7 @@ This module creates a single nullplatform_provider_config resource of type docke
 
 ```hcl
 module "docker_server" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v7.8.0"
 
   login_server = "your-login-server"
   nrn          = "your-nrn"
diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md
index f3b93ac3..67fcfd70 100644
--- a/nullplatform/asset/ecr/README.md
+++ b/nullplatform/asset/ecr/README.md
@@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v7.8.0"
 
   application_role_arn             = "your-application-role-arn"
   build_workflow_access_key_id     = "your-build-workflow-access-key-id"
diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md
index 8de6828e..5e2a0df8 100644
--- a/nullplatform/asset/s3/README.md
+++ b/nullplatform/asset/s3/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v7.8.0"
 
   bucket_name = "your-bucket-name"
   nrn         = "your-nrn"
diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md
index e3ce6b1a..8865fa34 100644
--- a/nullplatform/base/README.md
+++ b/nullplatform/base/README.md
@@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "your-k8s-provider"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -34,7 +34,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "eks"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -46,7 +46,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "gke"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -58,7 +58,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "aks"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -70,7 +70,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "oke"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -82,7 +82,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.8.0"
 
   k8s_provider                   = "aro"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md
index dd229544..1163e792 100644
--- a/nullplatform/cloud/aws/cloud/README.md
+++ b/nullplatform/cloud/aws/cloud/README.md
@@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v7.8.0"
 
   domain_name            = "your-domain-name"
   hosted_private_zone_id = "your-hosted-private-zone-id"
diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md
index 39127130..17ce4f37 100644
--- a/nullplatform/cloud/aws/vpc/README.md
+++ b/nullplatform/cloud/aws/vpc/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v7.8.0"
 
   nrn                 = "your-nrn"
   vpc_id              = "your-vpc-id"
diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md
index 6c11a578..d0c0c238 100644
--- a/nullplatform/cloud/azure/cloud/README.md
+++ b/nullplatform/cloud/azure/cloud/README.md
@@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v7.8.0"
 
   azure_resource_group_name       = "your-azure-resource-group-name"
   nrn                             = "your-nrn"
diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md
index 23f0224d..39839a90 100644
--- a/nullplatform/cloud/gcp/cloud/README.md
+++ b/nullplatform/cloud/gcp/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v7.8.0"
 
   domain_name = "your-domain-name"
   location    = "your-location"
diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md
index 7eaa8d39..12e0bbaf 100644
--- a/nullplatform/cloud/oci/cloud/README.md
+++ b/nullplatform/cloud/oci/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v7.8.0"
 
   account_id       = "your-account-id"
   account_name     = "your-account-name"
diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md
index 58977d1a..e687e1c8 100644
--- a/nullplatform/code_repository/README.md
+++ b/nullplatform/code_repository/README.md
@@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.8.0"
 
   git_provider = "your-git-provider"
   nrn          = "your-nrn"
@@ -33,7 +33,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.8.0"
 
   git_provider           = "github"
   github_installation_id = "your-github-installation-id"  # Required when git_provider = "github"
@@ -46,7 +46,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.8.0"
 
   git_provider             = "gitlab"
   gitlab_access_token      = "your-gitlab-access-token"  # Required when git_provider = "gitlab"
@@ -62,7 +62,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.8.0"
 
   azure_access_token = "your-azure-access-token"  # Required when git_provider = "azure"
   azure_agent_pool   = "your-azure-agent-pool"  # Required when git_provider = "azure"
@@ -76,7 +76,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.8.0"
 
   bitbucket_collaborators    = "your-bitbucket-collaborators"  # Required when git_provider = "bitbucket"
   bitbucket_installation_url = "your-bitbucket-installation-url"  # Required when git_provider = "bitbucket"
diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md
index cc4651ec..70a51056 100644
--- a/nullplatform/container_orchestration/aks/README.md
+++ b/nullplatform/container_orchestration/aks/README.md
@@ -22,7 +22,7 @@ The module constructs a set of structured locals that merge optional and require
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -36,7 +36,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -50,7 +50,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -64,7 +64,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md
index 3c47726f..ca47fa29 100644
--- a/nullplatform/container_orchestration/eks/README.md
+++ b/nullplatform/container_orchestration/eks/README.md
@@ -22,7 +22,7 @@ The module constructs a structured attributes map from input variables using Ter
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -34,7 +34,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -46,7 +46,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -58,7 +58,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md
index 5f96d7a2..25a2b750 100644
--- a/nullplatform/container_orchestration/gke/README.md
+++ b/nullplatform/container_orchestration/gke/README.md
@@ -22,7 +22,7 @@ The module constructs a set of local values by merging optional inputs into a st
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -36,7 +36,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -50,7 +50,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -64,7 +64,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.8.0"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md
index c02a7d02..bb9c7129 100644
--- a/nullplatform/container_orchestration/oke/README.md
+++ b/nullplatform/container_orchestration/oke/README.md
@@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v7.8.0"
 
   cluster_name = "your-cluster-name"
   nrn          = "your-nrn"
diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md
index f7f7fb95..9d9794f4 100644
--- a/nullplatform/dimension/README.md
+++ b/nullplatform/dimension/README.md
@@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or
 
 ```hcl
 module "dimension" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v7.8.0"
 
   name = "your-name"
   nrn  = "your-nrn"
diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md
index 0b63b829..f7714f9d 100644
--- a/nullplatform/dimension_value/README.md
+++ b/nullplatform/dimension_value/README.md
@@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres
 
 ```hcl
 module "dimension_value" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v7.8.0"
 
   dimension_id = "your-dimension-id"
   name         = "your-name"
diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md
index 302f2d26..7a32cc8c 100644
--- a/nullplatform/identity-access-control/README.md
+++ b/nullplatform/identity-access-control/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity
 
 ```hcl
 module "identity-access-control" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v7.8.0"
 
   attributes = "your-attributes"
   nrn        = "your-nrn"
diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md
index 4facc6a2..fba7a92e 100644
--- a/nullplatform/metrics/README.md
+++ b/nullplatform/metrics/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome
 
 ```hcl
 module "metrics" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v7.8.0"
 
   nrn = "your-nrn"
 }
diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md
index 57c74057..5647bfaa 100644
--- a/nullplatform/packaged_service/README.md
+++ b/nullplatform/packaged_service/README.md
@@ -22,7 +22,7 @@ The module accepts a flat `components` list and partitions it into spec componen
 
 ```hcl
 module "packaged_service" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v7.8.0"
 
   components = "your-components"
   nrn        = "your-nrn"
diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md
index 61495593..538baab3 100644
--- a/nullplatform/parameter_storage_configuration/README.md
+++ b/nullplatform/parameter_storage_configuration/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource named paramete
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.8.0"
 
   nrn  = "your-nrn"
   type = "your-type"
@@ -32,7 +32,7 @@ module "parameter_storage_configuration" {
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.8.0"
 
   nrn  = "your-nrn"
   type = "aws-secrets-manager"
@@ -43,7 +43,7 @@ module "parameter_storage_configuration" {
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.8.0"
 
   nrn  = "your-nrn"
   tier = "your-tier"  # Required when type = "aws-parameter-store"
diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md
index 5da55696..9e11562b 100644
--- a/nullplatform/parameter_storage_definition/README.md
+++ b/nullplatform/parameter_storage_definition/README.md
@@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable
 
 ```hcl
 module "parameter_storage_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v7.8.0"
 
   np_api_key    = "your-np-api-key"
   nrn           = "your-nrn"
diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md
index c0705303..1df5550b 100644
--- a/nullplatform/parameter_storage_definition_agent_association/README.md
+++ b/nullplatform/parameter_storage_definition_agent_association/README.md
@@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null
 
 ```hcl
 module "parameter_storage_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v7.8.0"
 
   api_key = "your-api-key"
   nrn     = "your-nrn"
diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md
index 5bacbacd..5536dbbe 100644
--- a/nullplatform/scope_configuration/README.md
+++ b/nullplatform/scope_configuration/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource, wiring the nr
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.8.0"
 
   nrn  = "your-nrn"
   type = "your-type"
@@ -32,7 +32,7 @@ module "scope_configuration" {
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.8.0"
 
   aws_hosted_public_zone_id = "your-aws-hosted-public-zone-id"  # Required when type = "static-files"
   aws_region                = "your-aws-region"  # Required when type = "static-files"
@@ -47,7 +47,7 @@ module "scope_configuration" {
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.8.0"
 
   lambda_placeholder_image_uri = "your-lambda-placeholder-image-uri"  # Required when type = "aws-lambda"
   lambda_tofu_state_bucket     = "your-lambda-tofu-state-bucket"  # Required when type = "aws-lambda"
diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md
index 2c1111bf..78d8ac5d 100644
--- a/nullplatform/scope_definition/README.md
+++ b/nullplatform/scope_definition/README.md
@@ -22,7 +22,7 @@ The module fetches remote JSON templates via `data.http` resources and processes
 
 ```hcl
 module "scope_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v7.8.0"
 
   np_api_key = "your-np-api-key"
   nrn        = "your-nrn"
diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md
index 5d4b16f0..8e214dc7 100644
--- a/nullplatform/scope_definition_agent_association/README.md
+++ b/nullplatform/scope_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `http` data sour
 
 ```hcl
 module "scope_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v7.8.0"
 
   api_key                  = "your-api-key"
   nrn                      = "your-nrn"
diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index 9e877b0c..4c0118e2 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -22,7 +22,7 @@ The module uses `data.http` resources to fetch JSON template files from GitHub,
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.8.0"
 
   nrn               = "your-nrn"
   repository_branch = "your-repository-branch"
@@ -35,7 +35,7 @@ module "service_definition" {
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.8.0"
 
   nrn               = "your-nrn"
   repository_branch = "v1.4.0"
diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md
index 21822c93..44b1717d 100644
--- a/nullplatform/service_definition_agent_association/README.md
+++ b/nullplatform/service_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module creates a `terraform_data` resource to track API key changes and trig
 
 ```hcl
 module "service_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v7.8.0"
 
   api_key        = "your-api-key"
   tags_selectors = "your-tags-selectors"
diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md
index 3c018de7..f8f149bf 100644
--- a/nullplatform/users/README.md
+++ b/nullplatform/users/README.md
@@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res
 
 ```hcl
 module "users" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v7.7.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v7.8.0"
 
   nullplatform_users = "your-nullplatform-users"
 }