diff --git a/.envrc b/.envrc
index d243e16..1d1d2d3 100644
--- a/.envrc
+++ b/.envrc
@@ -3,6 +3,4 @@
 # matches the tfroot-runner CI image (which symlinks tofu→terraform) and is
 # required because the s3 backend config uses tofu-only attributes
 # (assume_role_duration_seconds) that the HashiCorp terraform binary rejects.
-#
-# Auto-sourced by direnv on cd. Non-direnv users: see AGENTS.md.
 export PCT_TFPATH="$(command -v tofu)"
diff --git a/.gitignore b/.gitignore
index c3767df..d9c0554 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-# vim swap files
 **/*.sw[po]
 
 # don't commit terraform state or lock. the repo code is the only state we care about.
@@ -6,13 +5,10 @@
 **/.terraform.lock.hcl
 **/.terraform
 
-# IDE Folders
 **/.vscode
 
-# Mac Finder cache
 **/.DS_Store
 
-# Plan output
 plan-output.txt
 tfplan.bin
 
diff --git a/cloud-init/k3s/cloud_init.cfg b/cloud-init/k3s/cloud_init.cfg
index 3166373..e66d6d0 100644
--- a/cloud-init/k3s/cloud_init.cfg
+++ b/cloud-init/k3s/cloud_init.cfg
@@ -1,6 +1,4 @@
 #cloud-config
-# https://cloudinit.readthedocs.io/en/latest/topics/examples.html
-
 # AGE private key for KSOPS, written to tmpfs so it does not survive reboot.
 # Loaded into the argocd/sops-age-keys Secret in runcmd via --from-file.
 write_files:
@@ -119,7 +117,6 @@ runcmd:
     kubectl -n argocd-operator-system set env \
       deployment/argocd-operator-controller-manager \
       ARGOCD_CLUSTER_CONFIG_NAMESPACES=argocd
-  # Self-signed Issuer + Certificate for the operator's admission webhook.
   # Service name comes from config/default's namePrefix + ../webhook/service.yaml.
   - |
     set -e
diff --git a/cloud-init/runner/cloud_init.cfg b/cloud-init/runner/cloud_init.cfg
index eb7f70c..3395dda 100644
--- a/cloud-init/runner/cloud_init.cfg
+++ b/cloud-init/runner/cloud_init.cfg
@@ -1,21 +1,15 @@
 #cloud-config
-# https://cloudinit.readthedocs.io/en/latest/topics/examples.html
-
 write_files:
   - path: /usr/local/bin/docker-cleanup.sh
     permissions: '0755'
     content: |
       #!/bin/bash
-      # Prune old Docker images, keeping only the most recent per repository
-      # Also cleans dangling images and old build cache
-
+      # Bound runner disk growth while retaining the newest image per
+      # repository and seven days of reusable build cache.
       set -euo pipefail
 
-      # Remove dangling images (untagged, intermediate layers)
       docker image prune -f
 
-      # Remove older tags, keeping only the most recently created per repository
-      # Skip repositories with only one image
       docker images --format '{{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.CreatedAt}}' | \
         grep -v '^<none>' | \
         sort -t$'\t' -k1,1 -k4,4r | \
@@ -31,7 +25,6 @@ write_files:
           }
         ' | sort -u | xargs -r docker rmi 2>/dev/null || true
 
-      # Prune build cache older than 7 days
       docker builder prune -f --filter "until=168h"
 
   - path: /usr/local/bin/runner-work-cleanup.sh
diff --git a/main.tf b/main.tf
index 4261831..257bb32 100644
--- a/main.tf
+++ b/main.tf
@@ -3,11 +3,9 @@ data "sops_file" "secret_vars" {
 }
 
 locals {
-  # Boot images
   # Direct mirror that provides Content-Length header (required by libvirt provider)
   fedora_image_url = "https://dl.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/x86_64/images/Fedora-Cloud-Base-Generic-44-1.7.x86_64.qcow2"
 
-  # GitHub
   github_org = "makeitworkcloud"
 
   # ArgoCD bootstrap target — kustomize-cluster's bootstrap/ kustomization
@@ -17,20 +15,19 @@ locals {
   cluster_repo_branch = "main"
   cluster_repo_path   = "bootstrap"
 
-  # k3s
   k3s_ip      = "192.168.102.2"
-  k3s_version = "v1.31.13+k3s1" # bump as needed; see https://github.com/k3s-io/k3s/releases
+  k3s_version = "v1.31.13+k3s1"
 
   # argocd-operator (community) — provides the argoproj.io/v1beta1 ArgoCD CRD
   # consumed by kustomize-cluster/bootstrap/argocd-config.yaml
-  argocd_operator_version = "v0.14.1" # bump as needed; see https://github.com/argoproj-labs/argocd-operator/releases
+  argocd_operator_version = "v0.14.1"
 
   # cert-manager — argocd-operator's config/default mounts a webhook-server-cert
   # Secret that only materializes via cert-manager. Installed during k3s
   # bootstrap (before argocd-operator) so argocd-operator can come up and
   # reconcile the ArgoCD CR; ClusterIssuer/Issuer resources are managed by
   # ArgoCD downstream.
-  cert_manager_version = "v1.20.3" # bump as needed; see https://github.com/cert-manager/cert-manager/releases
+  cert_manager_version = "v1.20.3"
 }
 
 # Dedicated libvirt pool on /mnt/nvme RAID-1 for cluster volumes (keeps cluster IO off the root LV).
diff --git a/opencode.json b/opencode.json
index 5289d54..f7777ca 100644
--- a/opencode.json
+++ b/opencode.json
@@ -16,6 +16,7 @@
     "aws-prod": {"enabled": false},
     "grafana": {"enabled": false},
     "terraform-docs": {"enabled": false},
+    "argocd-makeitwork": {"enabled": true},
     "argocd-staging-eks": {"enabled": false},
     "argocd-prod-eks": {"enabled": false}
   },
@@ -30,6 +31,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": true,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }