diff --git a/CHANGELOG.md b/CHANGELOG.md
index c6a4c2b9..74f9a554 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [7.9.1](https://github.com/nullplatform/tofu-modules/compare/v7.9.0...v7.9.1) (2026-09-14)
+
+
+### Bug Fixes
+
+* deploy workloads into their own namespace, not the agent's ([#585](https://github.com/nullplatform/tofu-modules/issues/585)) ([b99b7d0](https://github.com/nullplatform/tofu-modules/commit/b99b7d0eeaa8369ed9f01b5e872e96e7e1f64183))
+
 ## [7.9.0](https://github.com/nullplatform/tofu-modules/compare/v7.8.1...v7.9.0) (2026-09-11)
 
 
diff --git a/VERSIONS.md b/VERSIONS.md
index ba58e6b1..69a5338a 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -14,14 +14,14 @@ a specific release, so an upgrade is something someone decides.
 
 ## What to pin
 
-Verified 2026-09-11.
+Verified 2026-09-14.
 
 | Component | Current | Variable | Module |
 | --- | --- | --- | --- |
 | `nullplatform-base` chart | `2.44.6` | `nullplatform_base_helm_version` | `nullplatform/base` |
 | `nullplatform-agent` chart | `3.0.0` | `nullplatform_agent_helm_version` | `nullplatform/agent` |
 | `cert-manager` chart | `v1.21.2` | `cert_manager_version` | `infrastructure/commons/cert_manager` |
-| `prometheus` chart | `29.28.1` | `prometheus_version` | `infrastructure/commons/prometheus` |
+| `prometheus` chart | `29.30.0` | `prometheus_version` | `infrastructure/commons/prometheus` |
 | `istio-base` chart | `1.30.4` | `istio_base_version` | `infrastructure/commons/istio` |
 | `istiod` chart | `1.30.4` | `istiod_version` | `infrastructure/commons/istio` |
 | `gateway-api` CRDs | `v1.5.1` | `gateway_api_crd_ref` | `nullplatform/base` |
@@ -66,7 +66,7 @@ module "cert_manager" {
 }
 
 module "prometheus" {
-  prometheus_version = "29.28.1"
+  prometheus_version = "29.30.0"
 }
 
 module "istio" {
diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md
index 8131a8cd..196f778a 100644
--- a/infrastructure/aws/acm/README.md
+++ b/infrastructure/aws/acm/README.md
@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v7.9.1"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"
diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md
index cb2b198d..22dae73c 100644
--- a/infrastructure/aws/aws_load_balancer_controller/README.md
+++ b/infrastructure/aws/aws_load_balancer_controller/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"
diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md
index 78289816..d221e5a5 100644
--- a/infrastructure/aws/backend/README.md
+++ b/infrastructure/aws/backend/README.md
@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v7.9.1"
 }
 ```
 
diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md
index acab4b17..cf8625fb 100644
--- a/infrastructure/aws/dns/README.md
+++ b/infrastructure/aws/dns/README.md
@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v7.9.1"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"
diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
index c4e0c455..dc959e4e 100644
--- a/infrastructure/aws/eks/README.md
+++ b/infrastructure/aws/eks/README.md
@@ -22,7 +22,7 @@ The module wraps `terraform-aws-modules/eks/aws` (which internally creates `aws_
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v7.9.1"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"
diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md
index 8a240675..946f67e8 100644
--- a/infrastructure/aws/iam/agent/README.md
+++ b/infrastructure/aws/iam/agent/README.md
@@ -21,7 +21,7 @@ The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-acco
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v7.9.1"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
index f58ebb35..7122aff4 100644
--- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
+++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v7.9.1"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"
diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
index b85e3d26..ad8c1695 100644
--- a/infrastructure/aws/iam/cert_manager/README.md
+++ b/infrastructure/aws/iam/cert_manager/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md
index c75c50f2..d649458a 100644
--- a/infrastructure/aws/iam/ci-build-workflow-user/README.md
+++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md
@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/cloudwatch/README.md b/infrastructure/aws/iam/cloudwatch/README.md
index cfdb472b..077d466a 100644
--- a/infrastructure/aws/iam/cloudwatch/README.md
+++ b/infrastructure/aws/iam/cloudwatch/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_policy granting CloudWatch Logs and Metrics write
 
 ```hcl
 module "cloudwatch" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cloudwatch?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md
index 75195ec8..8b1581f3 100644
--- a/infrastructure/aws/iam/ecr/README.md
+++ b/infrastructure/aws/iam/ecr/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v7.9.1"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"
diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
index f9070948..3041f432 100644
--- a/infrastructure/aws/iam/external_dns/README.md
+++ b/infrastructure/aws/iam/external_dns/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/s3/README.md b/infrastructure/aws/iam/s3/README.md
index ff06a2fe..99b933b7 100644
--- a/infrastructure/aws/iam/s3/README.md
+++ b/infrastructure/aws/iam/s3/README.md
@@ -18,7 +18,7 @@ The module creates an aws_iam_policy resource that allows s3:PutObject and s3:Ge
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3?ref=v7.9.1"
 
   bucket                    = "your-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"
diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md
index 6839f9b2..1c433e70 100644
--- a/infrastructure/aws/ingress/README.md
+++ b/infrastructure/aws/ingress/README.md
@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v7.9.1"
 
   certificate_arn = "your-certificate-arn"
 }
diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md
index bc91758d..ab7c50b8 100644
--- a/infrastructure/aws/security/README.md
+++ b/infrastructure/aws/security/README.md
@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to automatically derive
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md
index 60285bf7..823085f5 100644
--- a/infrastructure/aws/vpc/README.md
+++ b/infrastructure/aws/vpc/README.md
@@ -21,7 +21,7 @@ The module wraps the terraform-aws-modules/vpc/aws community module to provision
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v7.9.1"
 
   account      = "your-account"
   organization = "your-organization"
diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md
index f341eddb..581751f4 100644
--- a/infrastructure/azure/acr/README.md
+++ b/infrastructure/azure/acr/README.md
@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v7.9.1"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"
diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md
index 108467e4..7854c224 100644
--- a/infrastructure/azure/aks/README.md
+++ b/infrastructure/azure/aks/README.md
@@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and wir
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v7.9.1"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"
diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md
index 055de980..6927be20 100644
--- a/infrastructure/azure/aks_route_table/README.md
+++ b/infrastructure/azure/aks_route_table/README.md
@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the AKS-managed rou
 
 ```hcl
 module "aks_route_table" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v7.9.1"
 
   node_resource_group = "your-node-resource-group"
   subnet_id           = "your-subnet-id"
diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md
index d840f00a..8ed9edb9 100644
--- a/infrastructure/azure/dns/README.md
+++ b/infrastructure/azure/dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v7.9.1"
 
   domain_name         = "your-domain-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md
index c65e52b0..3705f179 100644
--- a/infrastructure/azure/iam/README.md
+++ b/infrastructure/azure/iam/README.md
@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v7.9.1"
 
   location             = "your-location"
   name                 = "your-name"
diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md
index c30ac0fb..38a50f8f 100644
--- a/infrastructure/azure/private_dns/README.md
+++ b/infrastructure/azure/private_dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
 
 ```hcl
 module "private_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v7.9.1"
 
   domain_name           = "your-domain-name"
   resource_group_name   = "your-resource-group-name"
diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md
index 954ab7b1..439e5cbd 100644
--- a/infrastructure/azure/resource_group/README.md
+++ b/infrastructure/azure/resource_group/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
 
 ```hcl
 module "resource_group" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v7.9.1"
 
   location            = "your-location"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md
index 6f01d3cf..05b5a660 100644
--- a/infrastructure/azure/security/README.md
+++ b/infrastructure/azure/security/README.md
@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v7.9.1"
 
   cluster_name        = "your-cluster-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
index c63a7718..e1fe7618 100644
--- a/infrastructure/azure/vnet/README.md
+++ b/infrastructure/azure/vnet/README.md
@@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf
 
 ```hcl
 module "vnet" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v7.9.1"
 
   address_space       = "your-address-space"
   location            = "your-location"
diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md
index f7aa3c35..398dbd1f 100644
--- a/infrastructure/commons/cert_manager/README.md
+++ b/infrastructure/commons/cert_manager/README.md
@@ -22,7 +22,7 @@ Two core helm_release resources are created: cert-manager from charts.jetstack.i
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -36,7 +36,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -52,7 +52,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug              = "your-account-slug"
   azure_client_id           = "your-azure-client-id"  # Required when cloud_provider = "azure"
@@ -71,7 +71,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug           = "your-account-slug"
   cert_manager_version   = "your-cert-manager-version"
@@ -87,7 +87,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug         = "your-account-slug"
   aws_region           = "your-aws-region"  # Required when cloud_provider = "aws"
@@ -103,7 +103,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "your-cert-manager-version"
@@ -120,7 +120,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v7.9.1"
 
   account_slug         = "your-account-slug"
   cert_manager_version = "fixed semver string"
diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md
index 5a423fac..16e6502c 100644
--- a/infrastructure/commons/external_dns/README.md
+++ b/infrastructure/commons/external_dns/README.md
@@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource when create_name
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   dns_provider_name = "your-dns-provider-name"
   domain_filters    = "your-domain-filters"
@@ -33,7 +33,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   cloudflare_token  = "your-cloudflare-token"  # Required when dns_provider_name = "cloudflare"
   dns_provider_name = "cloudflare"
@@ -45,7 +45,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   aws_iam_role_arn  = "your-aws-iam-role-arn"  # Required when dns_provider_name = "aws"
   aws_identity_mode = "your-aws-identity-mode"  # Required when dns_provider_name = "aws"
@@ -61,7 +61,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   dns_provider_name        = "oci"
   domain_filters           = "your-domain-filters"
@@ -77,7 +77,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure"
@@ -95,7 +95,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure-private-dns"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure-private-dns"
@@ -113,7 +113,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v7.9.1"
 
   dns_provider_name         = "google"
   domain_filters            = "your-domain-filters"
diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md
index 4c6f7f06..9b61f748 100644
--- a/infrastructure/commons/istio/README.md
+++ b/infrastructure/commons/istio/README.md
@@ -21,7 +21,7 @@ The module creates two helm_release resources: istio-base (which installs the Is
 
 ```hcl
 module "istio" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v7.9.1"
 }
 ```
 
diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md
index 98edf1e9..bed73849 100644
--- a/infrastructure/commons/prometheus/README.md
+++ b/infrastructure/commons/prometheus/README.md
@@ -20,7 +20,7 @@ The module renders a YAML values file via templatefile() in locals.tf, injecting
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.1"
 
   prometheus_version = "your-prometheus-version"
 }
@@ -30,7 +30,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.1"
 
   prometheus_version = "latest"
 }
@@ -40,7 +40,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.1"
 
   prometheus_version = "main"
 }
@@ -50,7 +50,7 @@ module "prometheus" {
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v7.9.1"
 
   prometheus_version = "master"
 }
diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md
index c3e8b15f..b53fdccc 100644
--- a/infrastructure/gcp/artifact-registry/README.md
+++ b/infrastructure/gcp/artifact-registry/README.md
@@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource configured
 
 ```hcl
 module "artifact-registry" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v7.9.1"
 
   location      = "your-location"
   project_id    = "your-project-id"
diff --git a/infrastructure/gcp/backend/README.md b/infrastructure/gcp/backend/README.md
index bb32b58b..958f5069 100644
--- a/infrastructure/gcp/backend/README.md
+++ b/infrastructure/gcp/backend/README.md
@@ -22,7 +22,7 @@ The module creates a primary google_storage_bucket (tf_state) with a random_id s
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/backend?ref=v7.9.1"
 
   project_id = "your-project-id"
 }
diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md
index 64f73be1..25691321 100644
--- a/infrastructure/gcp/cloud-dns/README.md
+++ b/infrastructure/gcp/cloud-dns/README.md
@@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC
 
 ```hcl
 module "cloud-dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v7.9.1"
 
   domain_name = "your-domain-name"
   project_id  = "your-project-id"
diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md
index 77d8a51f..559cc0d9 100644
--- a/infrastructure/gcp/cloud-nat/README.md
+++ b/infrastructure/gcp/cloud-nat/README.md
@@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n
 
 ```hcl
 module "cloud-nat" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v7.9.1"
 
   nat_name    = "your-nat-name"
   network_id  = "your-network-id"
diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md
index d50659f9..0693b55f 100644
--- a/infrastructure/gcp/gke/README.md
+++ b/infrastructure/gcp/gke/README.md
@@ -22,7 +22,7 @@ The module conditionally creates either a `terraform-google-modules/kubernetes-e
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v7.9.1"
 
   cluster_name      = "your-cluster-name"
   ip_range_pods     = "your-ip-range-pods"
diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md
index 2698a8fd..bdf8d43c 100644
--- a/infrastructure/gcp/iam/README.md
+++ b/infrastructure/gcp/iam/README.md
@@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v7.9.1"
 
   project_id = "your-project-id"
 }
diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md
index bab79fc3..1c165904 100644
--- a/infrastructure/gcp/security/README.md
+++ b/infrastructure/gcp/security/README.md
@@ -22,7 +22,7 @@ The module uses data.google_container_cluster to derive the VPC network name and
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v7.9.1"
 
   cluster_name   = "your-cluster-name"
   gcp_project_id = "your-gcp-project-id"
diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md
index b841ad0d..c70b40a2 100644
--- a/infrastructure/gcp/vpc/README.md
+++ b/infrastructure/gcp/vpc/README.md
@@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v7.9.1"
 
   network_name = "your-network-name"
   project_id   = "your-project-id"
diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md
index b881e857..ad6e586d 100644
--- a/infrastructure/oci/backend/README.md
+++ b/infrastructure/oci/backend/README.md
@@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v7.9.1"
 
   compartment_id = "your-compartment-id"
   namespace      = "your-namespace"
diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md
index f73c273a..a96aecde 100644
--- a/infrastructure/oci/dns/README.md
+++ b/infrastructure/oci/dns/README.md
@@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v7.9.1"
 
   compartment_id = "your-compartment-id"
 }
diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md
index fb4dedd6..30a1f813 100644
--- a/infrastructure/oci/dynamic_groups/README.md
+++ b/infrastructure/oci/dynamic_groups/README.md
@@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting
 
 ```hcl
 module "dynamic_groups" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v7.9.1"
 
   cluster_id      = "your-cluster-id"
   compartment_id  = "your-compartment-id"
diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md
index abf48d91..4e68e096 100644
--- a/infrastructure/oci/oke/README.md
+++ b/infrastructure/oci/oke/README.md
@@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v7.9.1"
 
   api_endpoint_subnet_id = "your-api-endpoint-subnet-id"
   cluster_name           = "your-cluster-name"
diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md
index 2072a34f..b87b7c83 100644
--- a/infrastructure/oci/vcn/README.md
+++ b/infrastructure/oci/vcn/README.md
@@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets
 
 ```hcl
 module "vcn" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v7.9.1"
 }
 ```
 
diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md
index c0ef788e..d547193c 100644
--- a/nullplatform/account/README.md
+++ b/nullplatform/account/README.md
@@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each`
 
 ```hcl
 module "account" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v7.9.1"
 
   nullplatform_accounts = "your-nullplatform-accounts"
 }
diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index 536a2853..607d6f95 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -2,27 +2,27 @@
 
 ## Description
 
-Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring cloud-provider-specific identity, worker orchestration, ingress templates, and DNS settings
+Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring it for a specific cloud provider with worker orchestration, ingress routing, and DNS settings
 
 ## Architecture
 
-The module renders a YAML values document via templatefile() from locals.tf and passes it to a single helm_release resource named 'agent' targeting the nullplatform-agent chart. A terraform_data resource tracks the api_key for replacement triggers, and a second terraform_data resource enforces cross-variable preconditions (e.g. aws_iam_role_arn when cloud_provider is aws, Azure credentials when cloud_provider is azure). Worker orchestration config is built by merging computed patches (service account, memory limits, k8s scope env vars per package) with any caller-supplied worker overrides, and the final merged map flows into the Helm values template alongside cloud-provider-specific env blocks.
+The module renders a YAML values document via templatefile() from locals.tf and passes it to a single helm_release resource named 'agent' targeting the nullplatform-agent chart. A terraform_data resource tracks api_key changes and triggers helm_release replacement via replace_triggered_by, while a second terraform_data resource enforces cross-variable preconditions at plan time (e.g. aws_iam_role_arn required for AWS, Azure credentials required for Azure). Worker pod patches are constructed in locals as structured maps — merging cloud-specific env vars, k8s scope env vars, and service account settings — and serialized into the Helm values document that the helm_release consumes.
 
 ## Features
 
-- Deploys nullplatform-agent helm_release with atomic rollback, cleanup-on-fail, and capped history
-- Renders per-cloud-provider environment blocks (AWS IAM role ARN, Azure client credentials) into Helm values via templatefile
-- Configures worker orchestration patches per package slug, injecting ServiceAccount, memory limits, and k8s scope env vars
-- Selects ALB or Istio Gateway API ingress template paths based on worker_ingress and injects them as INITIAL_INGRESS_PATH, BLUE_GREEN_INGRESS_PATH, SERVICE_TEMPLATE worker env vars
-- Enforces pinned Helm chart and traffic-manager image versions, rejecting empty or moving references like 'latest'
-- Supports custom allowed container registries and additional worker patches merged additively with module defaults
-- Triggers full Helm release replacement via terraform_data when the api_key value changes
+- Deploys nullplatform agent as a helm_release with atomic rollback, cleanup-on-fail, and capped history
+- Configures cloud-provider-specific environment variables for AWS (IAM role ARN, cluster name), Azure (client ID/secret, tenant, subscription, resource group), GCP, and OCI
+- Injects k8s scope configuration (DNS_TYPE, DOMAIN, K8S_NAMESPACE, CLUSTER_NAME, TRAFFIC_CONTAINER_IMAGE, ingress template paths) into worker pods via per-package patches
+- Supports ALB and Istio ingress stacks by selecting the appropriate Gateway API or ALB Ingress template paths based on worker_ingress
+- Enforces pinned, non-moving version references for both the Helm chart version and the traffic manager image tag via input validation
+- Replaces the Helm release automatically when the API key changes using a terraform_data trigger and replace_triggered_by
+- Merges caller-supplied worker patches and allowed registries on top of module defaults without requiring callers to repeat base configuration
 
 ## Basic Usage
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -37,7 +37,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -54,7 +54,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -69,7 +69,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -90,7 +90,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -105,7 +105,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "your-agent-traffic-manager-tag"
   api_key                         = "your-api-key"
@@ -120,7 +120,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v7.9.1"
 
   agent_traffic_manager_tag       = "<fixed-semver e.g. 1.8.0>"
   api_key                         = "your-api-key"
@@ -189,7 +189,7 @@ resource "example_resource" "this" {
 | <a name="input_image_tag"></a> [image\_tag](#input\_image\_tag) | Image tag for the agent container image | `string` | n/a | yes |
 | <a name="input_init_scripts"></a> [init\_scripts](#input\_init\_scripts) | List of initialization scripts to execute during agent startup | `list(string)` | `[]` | no |
 | <a name="input_initial_ingress_path"></a> [initial\_ingress\_path](#input\_initial\_ingress\_path) | Path, inside the worker image, of the ingress/route template used on a scope's first deployment. Empty (default) uses the template worker\_ingress selects; set it only to point at a custom template. | `string` | `""` | no |
-| <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent will run | `string` | `"nullplatform-tools"` | no |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace where the nullplatform agent itself runs. This is NOT where scopes deploy their workloads — see var.workload\_namespace. | `string` | `"nullplatform-tools"` | no |
 | <a name="input_nullplatform_agent_helm_version"></a> [nullplatform\_agent\_helm\_version](#input\_nullplatform\_agent\_helm\_version) | No default: every install pins this deliberately — see VERSIONS.md. Version of the nullplatform agent Helm chart to deploy | `string` | n/a | yes |
 | <a name="input_private_gateway_name"></a> [private\_gateway\_name](#input\_private\_gateway\_name) | Name of the private/internal gateway used for routing | `string` | `"gateway-private"` | no |
 | <a name="input_private_hosted_zone_rg"></a> [private\_hosted\_zone\_rg](#input\_private\_hosted\_zone\_rg) | Resource group for private hosted zone | `string` | `null` | no |
@@ -204,21 +204,22 @@ resource "example_resource" "this" {
 | <a name="input_worker_k8s_packages"></a> [worker\_k8s\_packages](#input\_worker\_k8s\_packages) | Package slugs whose worker runs the k8s scope and must receive its env vars (DNS\_TYPE, K8S\_NAMESPACE, template paths, CLUSTER\_NAME, extra\_envs). Add every package that runs the k8s scope code, e.g. ["containers", "scheduled-task"]. | `list(string)` | <pre>[<br/>  "containers"<br/>]</pre> | no |
 | <a name="input_worker_memory_limit"></a> [worker\_memory\_limit](#input\_worker\_memory\_limit) | Memory limit for a worker-orchestrated package's pod (packages in var.worker\_orchestrated\_packages). The chart's own default is small enough to OOM mid-tofu-apply for packages that run real IaC tooling. | `string` | `"2Gi"` | no |
 | <a name="input_worker_orchestrated_packages"></a> [worker\_orchestrated\_packages](#input\_worker\_orchestrated\_packages) | Package slugs whose worker-orchestrator (package-exec) pods should run<br/>under var.service\_account\_name (the same IRSA identity as the agent<br/>itself) and var.worker\_memory\_limit, via a per-package worker-container<br/>patch. Add a package's slug here whenever its worker needs to assume an<br/>AWS role, or needs more memory than the chart's own default (e.g. to run<br/>tofu/terraform); a worker for a package not listed here falls back to the<br/>namespace's default ServiceAccount and the chart's own memory default.<br/><br/>This is separate from the "containers" scope's own k8s-deployment env<br/>vars (DNS\_TYPE, DOMAIN, etc.), which remain specific to that package<br/>regardless of what's listed here. | `list(string)` | <pre>[<br/>  "containers"<br/>]</pre> | no |
+| <a name="input_workload_namespace"></a> [workload\_namespace](#input\_workload\_namespace) | Kubernetes namespace scopes deploy their application pods into, handed to the k8s-scope workers as K8S\_NAMESPACE. Defaults to the k8s scope's own default, which is what every pre-worker agent used. | `string` | `"nullplatform"` | no |
 <!-- END_TF_DOCS -->
 
 <!-- BEGIN_AI_METADATA
 {
   "name": "agent",
-  "description": "Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring cloud-provider-specific identity, worker orchestration, ingress templates, and DNS settings",
-  "architecture": "The module renders a YAML values document via templatefile() from locals.tf and passes it to a single helm_release resource named 'agent' targeting the nullplatform-agent chart. A terraform_data resource tracks the api_key for replacement triggers, and a second terraform_data resource enforces cross-variable preconditions (e.g. aws_iam_role_arn when cloud_provider is aws, Azure credentials when cloud_provider is azure). Worker orchestration config is built by merging computed patches (service account, memory limits, k8s scope env vars per package) with any caller-supplied worker overrides, and the final merged map flows into the Helm values template alongside cloud-provider-specific env blocks.",
+  "description": "Deploys the nullplatform agent to a Kubernetes cluster via a Helm chart, configuring it for a specific cloud provider with worker orchestration, ingress routing, and DNS settings",
+  "architecture": "The module renders a YAML values document via templatefile() from locals.tf and passes it to a single helm_release resource named 'agent' targeting the nullplatform-agent chart. A terraform_data resource tracks api_key changes and triggers helm_release replacement via replace_triggered_by, while a second terraform_data resource enforces cross-variable preconditions at plan time (e.g. aws_iam_role_arn required for AWS, Azure credentials required for Azure). Worker pod patches are constructed in locals as structured maps — merging cloud-specific env vars, k8s scope env vars, and service account settings — and serialized into the Helm values document that the helm_release consumes.",
   "features": [
-    "Deploys nullplatform-agent helm_release with atomic rollback, cleanup-on-fail, and capped history",
-    "Renders per-cloud-provider environment blocks (AWS IAM role ARN, Azure client credentials) into Helm values via templatefile",
-    "Configures worker orchestration patches per package slug, injecting ServiceAccount, memory limits, and k8s scope env vars",
-    "Selects ALB or Istio Gateway API ingress template paths based on worker_ingress and injects them as INITIAL_INGRESS_PATH, BLUE_GREEN_INGRESS_PATH, SERVICE_TEMPLATE worker env vars",
-    "Enforces pinned Helm chart and traffic-manager image versions, rejecting empty or moving references like 'latest'",
-    "Supports custom allowed container registries and additional worker patches merged additively with module defaults",
-    "Triggers full Helm release replacement via terraform_data when the api_key value changes"
+    "Deploys nullplatform agent as a helm_release with atomic rollback, cleanup-on-fail, and capped history",
+    "Configures cloud-provider-specific environment variables for AWS (IAM role ARN, cluster name), Azure (client ID/secret, tenant, subscription, resource group), GCP, and OCI",
+    "Injects k8s scope configuration (DNS_TYPE, DOMAIN, K8S_NAMESPACE, CLUSTER_NAME, TRAFFIC_CONTAINER_IMAGE, ingress template paths) into worker pods via per-package patches",
+    "Supports ALB and Istio ingress stacks by selecting the appropriate Gateway API or ALB Ingress template paths based on worker_ingress",
+    "Enforces pinned, non-moving version references for both the Helm chart version and the traffic manager image tag via input validation",
+    "Replaces the Helm release automatically when the API key changes using a terraform_data trigger and replace_triggered_by",
+    "Merges caller-supplied worker patches and allowed registries on top of module defaults without requiring callers to repeat base configuration"
   ],
   "inputs": [
     {
@@ -298,7 +299,12 @@ resource "example_resource" "this" {
     },
     {
       "name": "namespace",
-      "description": "Kubernetes namespace where the nullplatform agent will run",
+      "description": "Kubernetes namespace where the nullplatform agent itself runs. This is NOT where scopes deploy their workloads — see var.workload_namespace.",
+      "required": false
+    },
+    {
+      "name": "workload_namespace",
+      "description": "Kubernetes namespace scopes deploy their application pods into, handed to the k8s-scope workers as K8S_NAMESPACE. Defaults to the k8s scope's own default, which is what every pre-worker agent used.",
       "required": false
     },
     {
@@ -408,6 +414,6 @@ resource "example_resource" "this" {
     }
   ],
   "outputs": [],
-  "hash": "c53acb3fea4c2203d6bdd11c8a159c38"
+  "hash": "3d8dc5004ffa68f0b1a6a2d86601e514"
 }
 END_AI_METADATA -->
diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md
index b544f67c..f5049c4f 100644
--- a/nullplatform/api_key/README.md
+++ b/nullplatform/api_key/README.md
@@ -21,7 +21,7 @@ The module defines a single nullplatform_api_key resource whose name, grants, an
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   type = "your-type"
 }
@@ -31,7 +31,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   nrn  = "your-nrn"  # Required when type = "agent"
   type = "agent"
@@ -42,7 +42,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   nrn  = "your-nrn"  # Required when type = "base"
   type = "base"
@@ -53,7 +53,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   nrn                = "your-nrn"  # Required when type = "scope_notification"
   specification_slug = "your-specification-slug"  # Required when type = "scope_notification"
@@ -65,7 +65,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   nrn                = "your-nrn"  # Required when type = "service_notification"
   specification_slug = "your-specification-slug"  # Required when type = "service_notification"
@@ -77,7 +77,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v7.9.1"
 
   custom_name       = "your-custom-name"  # Required when type = "custom"
   custom_role_slugs = "your-custom-role-slugs"  # Required when type = "custom"
diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md
index 1955a93c..fad2bd44 100644
--- a/nullplatform/asset/docker_server/README.md
+++ b/nullplatform/asset/docker_server/README.md
@@ -20,7 +20,7 @@ This module creates a single nullplatform_provider_config resource of type docke
 
 ```hcl
 module "docker_server" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v7.9.1"
 
   login_server = "your-login-server"
   nrn          = "your-nrn"
diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md
index db745f34..7f4da52e 100644
--- a/nullplatform/asset/ecr/README.md
+++ b/nullplatform/asset/ecr/README.md
@@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v7.9.1"
 
   application_role_arn             = "your-application-role-arn"
   build_workflow_access_key_id     = "your-build-workflow-access-key-id"
diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md
index 0c6f4a88..e027c97e 100644
--- a/nullplatform/asset/s3/README.md
+++ b/nullplatform/asset/s3/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v7.9.1"
 
   bucket_name = "your-bucket-name"
   nrn         = "your-nrn"
diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md
index 1c852baa..6a76fbb9 100644
--- a/nullplatform/base/README.md
+++ b/nullplatform/base/README.md
@@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "your-k8s-provider"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -34,7 +34,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "eks"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -46,7 +46,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "gke"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -58,7 +58,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "aks"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -70,7 +70,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "oke"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
@@ -82,7 +82,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v7.9.1"
 
   k8s_provider                   = "aro"
   logging_controller_image_tag   = "your-logging-controller-image-tag"
diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md
index b045bc8c..26a17d29 100644
--- a/nullplatform/cloud/aws/cloud/README.md
+++ b/nullplatform/cloud/aws/cloud/README.md
@@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v7.9.1"
 
   domain_name            = "your-domain-name"
   hosted_private_zone_id = "your-hosted-private-zone-id"
diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md
index d60e5470..cadf1148 100644
--- a/nullplatform/cloud/aws/vpc/README.md
+++ b/nullplatform/cloud/aws/vpc/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource of type aws-ne
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v7.9.1"
 
   nrn                 = "your-nrn"
   vpc_id              = "your-vpc-id"
diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md
index 0b98abd7..98aa1b1b 100644
--- a/nullplatform/cloud/azure/cloud/README.md
+++ b/nullplatform/cloud/azure/cloud/README.md
@@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v7.9.1"
 
   azure_resource_group_name       = "your-azure-resource-group-name"
   nrn                             = "your-nrn"
diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md
index 0806e745..2f4e3cd3 100644
--- a/nullplatform/cloud/gcp/cloud/README.md
+++ b/nullplatform/cloud/gcp/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v7.9.1"
 
   domain_name = "your-domain-name"
   location    = "your-location"
diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md
index f8795f46..28de36e1 100644
--- a/nullplatform/cloud/oci/cloud/README.md
+++ b/nullplatform/cloud/oci/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v7.9.1"
 
   account_id       = "your-account-id"
   account_name     = "your-account-name"
diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md
index d32c07db..9f707439 100644
--- a/nullplatform/code_repository/README.md
+++ b/nullplatform/code_repository/README.md
@@ -22,7 +22,7 @@ The module uses local boolean flags (is_gitlab, is_github, is_azure, is_bitbucke
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.1"
 
   git_provider = "your-git-provider"
   nrn          = "your-nrn"
@@ -33,7 +33,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.1"
 
   git_provider           = "github"
   github_installation_id = "your-github-installation-id"  # Required when git_provider = "github"
@@ -46,7 +46,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.1"
 
   git_provider             = "gitlab"
   gitlab_access_token      = "your-gitlab-access-token"  # Required when git_provider = "gitlab"
@@ -62,7 +62,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.1"
 
   azure_access_token = "your-azure-access-token"  # Required when git_provider = "azure"
   azure_agent_pool   = "your-azure-agent-pool"  # Required when git_provider = "azure"
@@ -76,7 +76,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v7.9.1"
 
   bitbucket_collaborators    = "your-bitbucket-collaborators"  # Required when git_provider = "bitbucket"
   bitbucket_installation_url = "your-bitbucket-installation-url"  # Required when git_provider = "bitbucket"
diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md
index 018f27a5..0e3c7b40 100644
--- a/nullplatform/container_orchestration/aks/README.md
+++ b/nullplatform/container_orchestration/aks/README.md
@@ -22,7 +22,7 @@ The module constructs a set of structured locals that merge optional and require
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -36,7 +36,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -50,7 +50,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -64,7 +64,7 @@ module "aks" {
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md
index a63429e1..4cd23a39 100644
--- a/nullplatform/container_orchestration/eks/README.md
+++ b/nullplatform/container_orchestration/eks/README.md
@@ -22,7 +22,7 @@ The module constructs a structured attributes map from input variables using Ter
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -34,7 +34,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -46,7 +46,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
@@ -58,7 +58,7 @@ module "eks" {
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   nrn                     = "your-nrn"
diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md
index 6a0dde7a..fa5b876d 100644
--- a/nullplatform/container_orchestration/gke/README.md
+++ b/nullplatform/container_orchestration/gke/README.md
@@ -22,7 +22,7 @@ The module constructs a set of local values by merging optional inputs into a st
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -36,7 +36,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -50,7 +50,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
@@ -64,7 +64,7 @@ module "gke" {
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v7.9.1"
 
   cluster_name            = "your-cluster-name"
   location                = "your-location"
diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md
index b0c08674..00759e59 100644
--- a/nullplatform/container_orchestration/oke/README.md
+++ b/nullplatform/container_orchestration/oke/README.md
@@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v7.9.1"
 
   cluster_name = "your-cluster-name"
   nrn          = "your-nrn"
diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md
index fc320415..55983261 100644
--- a/nullplatform/dimension/README.md
+++ b/nullplatform/dimension/README.md
@@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or
 
 ```hcl
 module "dimension" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v7.9.1"
 
   name = "your-name"
   nrn  = "your-nrn"
diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md
index cfe36da7..05f1398e 100644
--- a/nullplatform/dimension_value/README.md
+++ b/nullplatform/dimension_value/README.md
@@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres
 
 ```hcl
 module "dimension_value" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v7.9.1"
 
   dimension_id = "your-dimension-id"
   name         = "your-name"
diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md
index dfc6e247..35821a7e 100644
--- a/nullplatform/identity-access-control/README.md
+++ b/nullplatform/identity-access-control/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity
 
 ```hcl
 module "identity-access-control" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v7.9.1"
 
   attributes = "your-attributes"
   nrn        = "your-nrn"
diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md
index 62546e2c..03a7fee6 100644
--- a/nullplatform/metrics/README.md
+++ b/nullplatform/metrics/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome
 
 ```hcl
 module "metrics" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v7.9.1"
 
   nrn = "your-nrn"
 }
diff --git a/nullplatform/packaged_service/README.md b/nullplatform/packaged_service/README.md
index aa77377a..c7f7eded 100644
--- a/nullplatform/packaged_service/README.md
+++ b/nullplatform/packaged_service/README.md
@@ -22,7 +22,7 @@ The module accepts a flat `components` list and partitions it into spec componen
 
 ```hcl
 module "packaged_service" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/packaged_service?ref=v7.9.1"
 
   components = "your-components"
   nrn        = "your-nrn"
diff --git a/nullplatform/parameter_storage_configuration/README.md b/nullplatform/parameter_storage_configuration/README.md
index 06568f82..a8124274 100644
--- a/nullplatform/parameter_storage_configuration/README.md
+++ b/nullplatform/parameter_storage_configuration/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource named paramete
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.1"
 
   nrn  = "your-nrn"
   type = "your-type"
@@ -32,7 +32,7 @@ module "parameter_storage_configuration" {
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.1"
 
   nrn  = "your-nrn"
   type = "aws-secrets-manager"
@@ -43,7 +43,7 @@ module "parameter_storage_configuration" {
 
 ```hcl
 module "parameter_storage_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_configuration?ref=v7.9.1"
 
   nrn  = "your-nrn"
   tier = "your-tier"  # Required when type = "aws-parameter-store"
diff --git a/nullplatform/parameter_storage_definition/README.md b/nullplatform/parameter_storage_definition/README.md
index 8d18d304..29fb8d30 100644
--- a/nullplatform/parameter_storage_definition/README.md
+++ b/nullplatform/parameter_storage_definition/README.md
@@ -20,7 +20,7 @@ A data.http resource fetches the raw specification template from a configurable
 
 ```hcl
 module "parameter_storage_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition?ref=v7.9.1"
 
   np_api_key    = "your-np-api-key"
   nrn           = "your-nrn"
diff --git a/nullplatform/parameter_storage_definition_agent_association/README.md b/nullplatform/parameter_storage_definition_agent_association/README.md
index 0a62d5cd..f7d11ed8 100644
--- a/nullplatform/parameter_storage_definition_agent_association/README.md
+++ b/nullplatform/parameter_storage_definition_agent_association/README.md
@@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes and a null
 
 ```hcl
 module "parameter_storage_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/parameter_storage_definition_agent_association?ref=v7.9.1"
 
   api_key = "your-api-key"
   nrn     = "your-nrn"
diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md
index 594b6880..0c1b62ef 100644
--- a/nullplatform/scope_configuration/README.md
+++ b/nullplatform/scope_configuration/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource, wiring the nr
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.1"
 
   nrn  = "your-nrn"
   type = "your-type"
@@ -32,7 +32,7 @@ module "scope_configuration" {
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.1"
 
   aws_hosted_public_zone_id = "your-aws-hosted-public-zone-id"  # Required when type = "static-files"
   aws_region                = "your-aws-region"  # Required when type = "static-files"
@@ -47,7 +47,7 @@ module "scope_configuration" {
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v7.9.1"
 
   lambda_placeholder_image_uri = "your-lambda-placeholder-image-uri"  # Required when type = "aws-lambda"
   lambda_tofu_state_bucket     = "your-lambda-tofu-state-bucket"  # Required when type = "aws-lambda"
diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md
index 665ef652..5378c6c8 100644
--- a/nullplatform/scope_definition/README.md
+++ b/nullplatform/scope_definition/README.md
@@ -22,7 +22,7 @@ The module fetches remote JSON templates via `data.http` resources and processes
 
 ```hcl
 module "scope_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v7.9.1"
 
   np_api_key = "your-np-api-key"
   nrn        = "your-nrn"
diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md
index ed7e36ec..c72e4621 100644
--- a/nullplatform/scope_definition_agent_association/README.md
+++ b/nullplatform/scope_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module fetches a notification channel JSON template via the `http` data sour
 
 ```hcl
 module "scope_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v7.9.1"
 
   api_key                  = "your-api-key"
   nrn                      = "your-nrn"
diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index dc95955c..6b6c062e 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -22,7 +22,7 @@ The module uses `data.http` resources to fetch service, action, and link spec te
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.1"
 
   nrn               = "your-nrn"
   repository_branch = "your-repository-branch"
@@ -35,7 +35,7 @@ module "service_definition" {
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.1"
 
   nrn               = "your-nrn"
   repository_branch = "github"
@@ -48,7 +48,7 @@ module "service_definition" {
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.1"
 
   nrn               = "your-nrn"
   repository_branch = "gitlab"
@@ -61,7 +61,7 @@ module "service_definition" {
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.1"
 
   nrn               = "your-nrn"
   repository_branch = "bitbucket"
@@ -74,7 +74,7 @@ module "service_definition" {
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v7.9.1"
 
   local_specs_path  = "your-local-specs-path"  # Required when repository_branch = "local"
   nrn               = "your-nrn"
diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md
index effa9c7b..0c4c2e29 100644
--- a/nullplatform/service_definition_agent_association/README.md
+++ b/nullplatform/service_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module creates a `terraform_data` resource to track API key changes and trig
 
 ```hcl
 module "service_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v7.9.1"
 
   api_key        = "your-api-key"
   tags_selectors = "your-tags-selectors"
diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md
index b0431a7e..741c74a1 100644
--- a/nullplatform/users/README.md
+++ b/nullplatform/users/README.md
@@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res
 
 ```hcl
 module "users" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v7.9.0"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v7.9.1"
 
   nullplatform_users = "your-nullplatform-users"
 }