diff --git a/.github/workflows/buildah.yml b/.github/workflows/buildah.yml
index ea526c7..9182b37 100644
--- a/.github/workflows/buildah.yml
+++ b/.github/workflows/buildah.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install hadolint
         run: |
@@ -38,12 +38,12 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Run pre-commit
-        uses: pre-commit/action@v3.0.1
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         env:
           SKIP: no-commit-to-branch
 
@@ -53,7 +53,7 @@ jobs:
       images: ${{ steps.find.outputs.images }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
 
@@ -63,13 +63,10 @@ jobs:
           INPUT_IMAGE: ${{ inputs.image }}
         run: |
           if [ -n "$INPUT_IMAGE" ]; then
-            # Specific image requested
             echo "images=[\"$INPUT_IMAGE\"]" >> "$GITHUB_OUTPUT"
           elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            # Manual trigger without specific image: build all
             echo "images=$(make list-images-json)" >> "$GITHUB_OUTPUT"
           else
-            # Push event: only build changed images
             echo "images=$(make changed-images)" >> "$GITHUB_OUTPUT"
           fi
 
@@ -87,7 +84,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install buildah and podman
         run: |
@@ -95,7 +92,7 @@ jobs:
           sudo apt-get install -y buildah podman
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v3
+        uses: redhat-actions/buildah-build@3a51aade9afa17e5c78256bcbe2e1ee08c7b995b # v3.0.2
         with:
           context: ${{ matrix.image }}
           containerfiles: ${{ matrix.image }}/Containerfile
@@ -109,7 +106,7 @@ jobs:
         if: |
           (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
           (github.event_name == 'workflow_dispatch' && inputs.mode == 'build & push')
-        uses: redhat-actions/push-to-registry@v3
+        uses: redhat-actions/push-to-registry@94ade333c38ecc0e60e94785125d9a52ca423b37 # v3.0.0
         with:
           image: ${{ matrix.image }}
           tags: latest ${{ github.sha }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c8bcbd5..4f7c110 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
     hooks:
       - id: check-case-conflict
       - id: check-merge-conflict
@@ -15,17 +15,17 @@ repos:
       - id: check-added-large-files
         args: ['--maxkb=1000']
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
     hooks:
       - id: gitleaks
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/hadolint/hadolint
-    rev: v2.15.1
+    rev: 2eece55955ced00200be9729e9728cb7dacca505 # v2.15.1
     hooks:
       - id: hadolint
         args: [--failure-threshold=error]
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
     hooks:
       - id: actionlint
diff --git a/Makefile b/Makefile
index 1eb95b2..6773c2a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,6 @@
 
 SHELL := /bin/bash
 
-# Find all directories containing a Containerfile
 IMAGES := $(shell find . -maxdepth 2 -name Containerfile -printf '%h\n' | cut -d'/' -f2 | sort -u)
 
 help:
@@ -11,17 +10,14 @@ help:
 	@echo "  list-images-json  - List all image directories as JSON array"
 	@echo "  changed-images    - List images with changes since HEAD~1 as JSON array"
 
-# List images with changes since HEAD~1 as JSON array
 changed-images:
 	@changed=$$(git diff --name-only HEAD~1 HEAD 2>/dev/null | cut -d'/' -f1 | sort -u); \
 	for img in $(IMAGES); do \
 		echo "$$changed" | grep -qx "$$img" && echo "$$img"; \
 	done | jq -R -s -c 'split("\n") | map(select(length > 0))'
 
-# List all image directories (one per line)
 list-images:
 	@for img in $(IMAGES); do echo "$$img"; done
 
-# List all image directories as JSON array
 list-images-json:
 	@echo '$(IMAGES)' | tr ' ' '\n' | jq -R -s -c 'split("\n") | map(select(length > 0))'
diff --git a/gh-cli/Containerfile b/gh-cli/Containerfile
index 30da9c6..bae7ab5 100644
--- a/gh-cli/Containerfile
+++ b/gh-cli/Containerfile
@@ -1,10 +1,8 @@
-# Minimal GitHub CLI image for automation tasks
 FROM alpine:3.24
 
 LABEL description="Minimal Alpine image with GitHub CLI for automation tasks"
 LABEL org.opencontainers.image.source="https://github.com/makeitworkcloud/images"
 
-# Single layer: install packages, create user, clean up
 # hadolint ignore=DL3018
 RUN apk add --no-cache github-cli bash \
     && adduser -D -u 1000 gh \
diff --git a/opencode.json b/opencode.json
index b9a08c4..cca3fdf 100644
--- a/opencode.json
+++ b/opencode.json
@@ -16,6 +16,7 @@
     "aws-prod": {"enabled": false},
     "grafana": {"enabled": false},
     "terraform-docs": {"enabled": false},
+    "argocd-makeitwork": {"enabled": true},
     "argocd-staging-eks": {"enabled": false},
     "argocd-prod-eks": {"enabled": false}
   },
@@ -31,6 +32,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": true,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }
diff --git a/tfroot-runner/Containerfile b/tfroot-runner/Containerfile
index 912c90b..ad7b058 100644
--- a/tfroot-runner/Containerfile
+++ b/tfroot-runner/Containerfile
@@ -1,14 +1,7 @@
-# tfroot-runner — GitHub ARC runner image preloaded with the OpenTofu IaC
-# toolchain. Self-registers with the gha-runner-scale-set listener; jobs run
-# directly in the pod (no nested `container:` block).
-#
 # Layout follows the hatch1fy/infra-images/terraform-runner pattern:
 #   Stage 1 (tools)  — Ubuntu builder for binary downloads + Python venv
 #   Stage 2 (final)  — ghcr.io/actions/actions-runner base + runtime deps
 
-##############################
-# Pinned versions — update here
-##############################
 ARG OPENTOFU_VERSION=1.12.5
 ARG SOPS_VERSION=3.13.3
 ARG TERRAFORM_DOCS_VERSION=0.24.0
@@ -24,9 +17,6 @@ ARG PYTHON_VERSION=3.14
 ARG YQ_VERSION=4.53.3
 ARG ACTIONS_RUNNER_VERSION=2.336.0
 
-##############################
-# Stage 1: Build/download tools
-##############################
 FROM --platform=linux/amd64 ubuntu:24.04 AS tools
 
 ARG OPENTOFU_VERSION
@@ -44,7 +34,6 @@ ARG PYTHON_VERSION
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Build-time dependencies (Python + add-apt-repository)
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates curl gnupg lsb-release software-properties-common unzip \
@@ -54,42 +43,31 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential libffi-dev git \
     && rm -rf /var/lib/apt/lists/*
 
-# Python venv with the pip-managed tools.
 RUN python${PYTHON_VERSION} -m venv /opt/venv \
     && /opt/venv/bin/pip install --no-cache-dir \
         pre-commit==${PRECOMMIT_VERSION} \
         checkov==${CHECKOV_VERSION}
 
-# Binary downloads — single layer, strip debug symbols at the end.
 # hadolint ignore=DL3003,DL4006
 RUN set -eux; \
-    # OpenTofu
     curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh \
         | sh -s -- --install-method standalone --opentofu-version "${OPENTOFU_VERSION}"; \
     # Symlink as terraform for tooling that hardcodes that name.
     ln -s /usr/local/bin/tofu /usr/local/bin/terraform; \
-    # SOPS
     curl -fsSL "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
         -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops; \
-    # kubectl
     curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
         -o /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl; \
-    # kustomize
     curl -fsSL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz" \
         | tar xz -C /usr/local/bin kustomize; \
-    # terraform-docs
     curl -fsSL "https://terraform-docs.io/dl/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz" \
         | tar xz -C /usr/local/bin terraform-docs && chmod +x /usr/local/bin/terraform-docs; \
-    # tfupdate
     curl -fsSL "https://github.com/minamijoyo/tfupdate/releases/download/v${TFUPDATE_VERSION}/tfupdate_${TFUPDATE_VERSION}_linux_amd64.tar.gz" \
         | tar xz -C /usr/local/bin tfupdate && chmod +x /usr/local/bin/tfupdate; \
-    # hcledit
     curl -fsSL "https://github.com/minamijoyo/hcledit/releases/download/v${HCLEDIT_VERSION}/hcledit_${HCLEDIT_VERSION}_linux_amd64.tar.gz" \
         | tar xz -C /usr/local/bin hcledit && chmod +x /usr/local/bin/hcledit; \
-    # tflint
     curl -fsSL "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" \
         -o /tmp/tflint.zip && unzip /tmp/tflint.zip -d /usr/local/bin/ && rm -f /tmp/tflint.zip; \
-    # infracost
     curl -fsSL "https://github.com/infracost/infracost/releases/download/v${INFRACOST_VERSION}/infracost-linux-amd64.tar.gz" \
         | tar xz -C /tmp && mv /tmp/infracost-linux-amd64 /usr/local/bin/infracost && chmod +x /usr/local/bin/infracost; \
     strip /usr/local/bin/tofu \
@@ -102,9 +80,6 @@ RUN set -eux; \
           /usr/local/bin/tflint \
           /usr/local/bin/infracost 2>/dev/null || true
 
-##############################
-# Stage 2: Final runner image
-##############################
 FROM --platform=linux/amd64 ghcr.io/actions/actions-runner:${ACTIONS_RUNNER_VERSION}
 
 ARG PYTHON_VERSION
@@ -118,8 +93,6 @@ USER root
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Runtime dependencies: Python (no -dev), ansible, openssh-client, jq/yq,
-# genisoimage (cdrkit equivalent), gnupg, make, shellcheck, libatomic1.
 # libatomic1 is needed by the Node.js binary pre-commit downloads for some hooks.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -135,7 +108,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /usr/share/doc/* /usr/share/man/*
 
-# Copy pre-built tools and the Python venv from the builder stage.
 COPY --from=tools /usr/local/bin/tofu /usr/local/bin/tofu
 COPY --from=tools /usr/local/bin/terraform /usr/local/bin/terraform
 COPY --from=tools /usr/local/bin/sops /usr/local/bin/sops
diff --git a/tfroot-runner/pre-commit-config.yaml b/tfroot-runner/pre-commit-config.yaml
index 4c43d26..c0e46e6 100644
--- a/tfroot-runner/pre-commit-config.yaml
+++ b/tfroot-runner/pre-commit-config.yaml
@@ -5,12 +5,12 @@
 # To update hooks for all tfroot repos, modify this file and rebuild the image.
 repos:
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v4.4.0
+    rev: 91ab4bf57e58b32adf1a122681f6ebe164d081c8 # v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.108.1
+    rev: bf9dd9c695ddaf238af36f179049202358ec22b7 # v1.108.1
     hooks:
       - id: terraform_validate
         args:
@@ -35,13 +35,13 @@ repos:
         args:
           - --args=--config=.terraform-docs.yml
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
     hooks:
       - id: gitleaks
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
     hooks:
       - id: check-case-conflict
       - id: check-merge-conflict