diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
index 10065e3..0594895 100644
--- a/.gds/bundle.lock.yaml
+++ b/.gds/bundle.lock.yaml
@@ -5,14 +5,14 @@ bundle:
   version: "0.4.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:bd945edbd404bff86af0a28a73ffae2c8398d306dc9960ae11e8e6ad146e9823"
-  digest: "sha256:715123490bb10ab566ffdc23bbea23e648a22d932b7eca859e53abbb39d1f53e"
+  source_tree_digest: "sha256:b091c872839681a6b51419aa37b68fe5217c0f540eef016f29da866200f5159e"
+  digest: "sha256:601df8bb6be0bf83c836c2b102f4af45a3d96f778fddec9b7521f840bdc5bf0b"
 
 projection:
-  input_digest: "sha256:0f0835ccefd7354609b379f4141cbe12123f2a215614cf1fac5e7762d894acff"
-  output_digest: "sha256:f0edd153a4d852760e6e2897f556bfe6ec9e2c632266694736b1a752c8efbd82"
+  input_digest: "sha256:e6403f1f645b0c407d9941b166f49ff6ef618d86c69c6a26ced927330714e8da"
+  output_digest: "sha256:6db94c0b3f9a474855c639ed07e04c368c0040fe0c1c8dc512dfdbe6c81e1565"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:e0330fa46e9943060b5b047f9c67b5604f89791c78239002e0f12871e1701752"
+      digest: "sha256:3c64b291efc3b61a3f0827748df178b4fe11d6b415feba1a48d9a803f47e0205"
diff --git a/.gds/repository.yaml b/.gds/repository.yaml
index 10838b5..b7c0377 100644
--- a/.gds/repository.yaml
+++ b/.gds/repository.yaml
@@ -77,7 +77,7 @@ ci:
   build_command: "go build -trimpath ./core/cmd/gds"
   test_command: "go test ./..."
   timeout_minutes: 30
-  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@18e2a7b0962783404f285e7acddbccb1e409e87f"
+  workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1"
   # A public repository, so GitHub-hosted runners are unmetered and a fork's
   # pull request cannot reach anything of ours. Self-hosted hardware here would
   # turn a fork PR into remote code execution on it.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4bae820..e902b43 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b50364e2a415267688c1d845cea6866cdb5e53d6 # 0.1.4
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@409817cf743e76383c84e30c72edf781d73b71a1 # 0.1.11
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned
diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
index 716194f..ffee354 100644
--- a/.github/workflows/gds-ci.yml
+++ b/.github/workflows/gds-ci.yml
@@ -1,9 +1,9 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.4.0-dev
-# source-tree-digest: sha256:bd945edbd404bff86af0a28a73ffae2c8398d306dc9960ae11e8e6ad146e9823
-# input-digest: sha256:0f0835ccefd7354609b379f4141cbe12123f2a215614cf1fac5e7762d894acff
-# output-digest: sha256:8f61a9ffd6949238099d4523a037d57199eb575f187cc8ac52baa4b5b832e79f
+# source-tree-digest: sha256:b091c872839681a6b51419aa37b68fe5217c0f540eef016f29da866200f5159e
+# input-digest: sha256:e6403f1f645b0c407d9941b166f49ff6ef618d86c69c6a26ced927330714e8da
+# output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@18e2a7b0962783404f285e7acddbccb1e409e87f
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -53,7 +53,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@18e2a7b0962783404f285e7acddbccb1e409e87f
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
index c77a40e..a86903b 100644
--- a/tests/golden/projections/control-plane/.claude/CLAUDE.md
+++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.4.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:6316bc3d6a8329f5d3fde6a8a65662951ed5dd2d1d0e289ad1fbc854b12a5347
+input-digest: sha256:d516e979d26eb08514c93e3b7cc2f0577ff8eef33340ba9e0dee51a561f86fbd
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml
diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
index 453dc5e..4fc082c 100644
--- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
+++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -9,14 +9,14 @@ bundle:
   digest: "sha256:d4645c8b942733304420ab2b92860914887b2cf90ea41dc6a836ac870a4b3182"
 
 projection:
-  input_digest: "sha256:6316bc3d6a8329f5d3fde6a8a65662951ed5dd2d1d0e289ad1fbc854b12a5347"
-  output_digest: "sha256:90378f1a9d0eed474a7086d7e7a61eed23ec164a1459c517befccf5e378f5a8e"
+  input_digest: "sha256:d516e979d26eb08514c93e3b7cc2f0577ff8eef33340ba9e0dee51a561f86fbd"
+  output_digest: "sha256:1ba6c42703257f4add3fb6307b2ad8640f9e4ee25403547e2343013ad121926c"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:015ddd21b921111bbfa39d5d8d6a13327bde00c8900912fe696054bfba8593b1"
+      digest: "sha256:d0fb0aeaa6219e9f5962a369e321c6ae47c0b2185d006e46ef55349a3f787dd1"
     - path: ".gds/compiled-policy.json"
       digest: "sha256:09752cc0cbe57dc3097f884927e2089a9730b9ebcf86ac27228812d54c5760f8"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:af9f5a3f03f00157dc98612c07a50a6ab7b4f7bb69d7cbf94dd3b7c914bbd26a"
+      digest: "sha256:61e492d4fddb2332f01d6c92788a4778f4c6c0afd48f82e0bede79e64de812df"
     - path: "AGENTS.md"
-      digest: "sha256:2b553edbafe7157a655577c5f756727657a609b8c73a342dc78d08ca7b3bd43e"
+      digest: "sha256:eec3204889eebec26623ae9e4c13800e91b60b2211372573effe6f5025f4a5bd"
diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
index 674f33a..6ee95c4 100644
--- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
+++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -2,8 +2,8 @@
 # generator: gds
 # bundle: 0.4.0-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:6316bc3d6a8329f5d3fde6a8a65662951ed5dd2d1d0e289ad1fbc854b12a5347
-# output-digest: sha256:8f61a9ffd6949238099d4523a037d57199eb575f187cc8ac52baa4b5b832e79f
+# input-digest: sha256:d516e979d26eb08514c93e3b7cc2f0577ff8eef33340ba9e0dee51a561f86fbd
+# output-digest: sha256:c268237f2cffde69b7868265ba6ac331048c98036fb9030ee7b7b3a208a9ad49
 # edit-source:
 #   - .gds/repository.yaml
 #   - policies/base/repository-default.yaml
@@ -33,7 +33,7 @@ jobs:
     name: GDS fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@18e2a7b0962783404f285e7acddbccb1e409e87f
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
     with:
       fetch_depth: 0
       # Public hosted CI uses GitHub's service cache; the pinned reusable
@@ -53,7 +53,7 @@ jobs:
     needs: fast
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@18e2a7b0962783404f285e7acddbccb1e409e87f
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@409817cf743e76383c84e30c72edf781d73b71a1
     with:
       fetch_depth: 0
       cache: true
diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
index 3e47e8d..416dea1 100644
--- a/tests/golden/projections/control-plane/AGENTS.md
+++ b/tests/golden/projections/control-plane/AGENTS.md
@@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
 bundle: 0.4.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:6316bc3d6a8329f5d3fde6a8a65662951ed5dd2d1d0e289ad1fbc854b12a5347
+input-digest: sha256:d516e979d26eb08514c93e3b7cc2f0577ff8eef33340ba9e0dee51a561f86fbd
 output-digest: sha256:198abbde694dcaccaf8126a8cc7d645830e1400a36604ca8864e4de4e69e8d18
 edit-source:
   - .gds/repository.yaml