diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3b7589..db29008 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,10 +11,10 @@ jobs:
   static-checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run pre-commit hooks
-        uses: pre-commit/action@v3.0.1
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
 
       - name: Check service worker syntax
         run: node --check makeitwork.cloud/sw.js
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fba4ce7..5a7b48f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,6 +1,4 @@
 ---
-# https://github.com/aws-actions/configure-aws-credentials
-#
 name: deploy
 on:
   push:
@@ -10,16 +8,16 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Static checks
-        uses: pre-commit/action@v3.0.1
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
 
       - name: Check service worker syntax
         run: node --check makeitwork.cloud/sw.js
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6.2.3
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -34,7 +32,7 @@ jobs:
           --exclude 'README.md'
 
       - name: Configure onion AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6.2.3
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.ONION_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.ONION_AWS_SECRET_ACCESS_KEY }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e18eadc..1e223a4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
@@ -12,13 +12,13 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
     hooks:
       - id: gitleaks
         entry: gitleaks dir --redact --verbose .
         pass_filenames: false
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
     hooks:
       - id: actionlint
   - repo: local
diff --git a/makeitwork.cloud/index.html b/makeitwork.cloud/index.html
index 59266e2..0395786 100644
--- a/makeitwork.cloud/index.html
+++ b/makeitwork.cloud/index.html
@@ -19,7 +19,6 @@
       http-equiv="onion-location"
       content="http://zvr4i7wkppsuj3czsxk3dtdkodbrvobre2ao57z4nebqgyijuwp6znad.onion"
     />
-    <!-- Open Graph -->
     <meta
       property="og:title"
       content="Make IT Work - Personal DevOps Portal & Cloud Infrastructure"
@@ -35,7 +34,6 @@
     <meta property="og:url" content="https://makeitwork.cloud/" />
     <meta property="og:type" content="website" />
     <meta property="og:site_name" content="Make IT Work" />
-    <!-- Twitter Cards -->
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="Make IT Work - DevOps Portal" />
     <meta
@@ -46,7 +44,6 @@
       name="twitter:image"
       content="https://makeitwork.cloud/android-chrome-512x512.png"
     />
-    <!-- Structured Data -->
     <script type="application/ld+json">
       {
         "@context": "https://schema.org",
@@ -68,7 +65,6 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <link rel="manifest" href="/site.webmanifest" />
     <meta name="theme-color" content="#0a0a0a" />
-    <!-- iOS PWA -->
     <meta name="apple-mobile-web-app-capable" content="yes" />
     <meta
       name="apple-mobile-web-app-status-bar-style"
@@ -144,7 +140,6 @@
         image-rendering: crisp-edges;
       }
 
-      /* ASCII Art Header */
       .cloud-header {
         text-align: center;
         margin-bottom: 2.5rem;
@@ -200,7 +195,6 @@
         }
       }
 
-      /* Cloud Resources Grid */
       .portal {
         width: 100%;
         max-width: 900px;
@@ -262,7 +256,6 @@
         vertical-align: middle;
       }
 
-      /* Resource Grid */
       .resource-grid {
         display: grid;
         grid-template-columns: 1fr;
@@ -282,7 +275,6 @@
         }
       }
 
-      /* Individual Resource Card */
       .resource {
         position: relative;
         display: flex;
@@ -365,7 +357,6 @@
         color: var(--gold-dim);
       }
 
-      /* WARP Note */
       .warp-note {
         font-family: "IBM VGA 8x14", monospace;
         font-size: 14px;
@@ -379,7 +370,6 @@
         color: var(--gold-dim);
       }
 
-      /* Maintenance Banner */
       .maintenance-banner {
         width: 100%;
         max-width: 900px;
@@ -448,7 +438,6 @@
         }
       }
 
-      /* Animations */
       @keyframes fadeIn {
         from {
           opacity: 0;
@@ -526,7 +515,6 @@
         }
       }
 
-      /* Scrollbar */
       ::-webkit-scrollbar {
         width: 6px;
       }
@@ -544,7 +532,6 @@
         background: var(--gold-dim);
       }
 
-      /* Install Banner */
       .install-banner {
         position: fixed;
         bottom: 0;
@@ -636,7 +623,6 @@
         color: var(--text-muted);
       }
 
-      /* iOS install instructions */
       .ios-instructions {
         display: none;
         font-family: "IBM VGA 8x14", monospace;
@@ -652,28 +638,11 @@
     </style>
   </head>
   <body>
-    <!-- Header -->
     <header class="cloud-header">
       <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
       <p class="subheader">Upon hearing this, the employee was enlightened.</p>
     </header>
 
-    <!-- Maintenance Banner — re-enable when needed
-    <div class="maintenance-banner">
-      <div class="maintenance-content">
-        <i class="fa-solid fa-triangle-exclamation maintenance-icon"></i>
-        <div class="maintenance-text">
-          <strong>Down for Maintenance</strong>
-          <span
-            >Several services will be unavailable this week while hardware
-            maintenance tasks are performed.</span
-          >
-        </div>
-      </div>
-    </div>
-    -->
-
-    <!-- Cloud Resources Grid -->
     <main class="portal">
       <div class="portal-border">
         <div class="resource-grid">
@@ -879,7 +848,6 @@ <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
       </nav>
     </main>
 
-    <!-- Install Banner -->
     <div id="installBanner" class="install-banner">
       <div class="install-banner-content">
         <img
@@ -905,12 +873,10 @@ <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
     </div>
 
     <script>
-      // Service Worker Registration
       if ("serviceWorker" in navigator) {
         navigator.serviceWorker.register("/sw.js").catch(() => {});
       }
 
-      // Install Prompt Logic
       (() => {
         const banner = document.getElementById("installBanner");
         const installBtn = document.getElementById("installBtn");
@@ -921,7 +887,6 @@ <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
         const DISMISSED_KEY = "pwa-install-dismissed";
         const DISMISS_DURATION = 7 * 24 * 60 * 60 * 1000; // 7 days
 
-        // Check if already installed or dismissed
         const isStandalone =
           window.matchMedia("(display-mode: standalone)").matches ||
           navigator.standalone === true;
@@ -932,17 +897,14 @@ <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
 
         if (isStandalone || wasDismissed) return;
 
-        // Detect iOS
         const isIOS =
           /iPad|iPhone|iPod/.test(navigator.userAgent) && !window.MSStream;
 
         if (isIOS) {
-          // iOS: Show banner with manual instructions
           iosInstructions.style.display = "block";
           installBtn.style.display = "none";
           setTimeout(() => banner.classList.add("visible"), 1000);
         } else {
-          // Android/Desktop: Use beforeinstallprompt
           window.addEventListener("beforeinstallprompt", (e) => {
             e.preventDefault();
             deferredPrompt = e;
@@ -960,13 +922,11 @@ <h1 class="site-title" itemprop="name">MAKE IT WORK</h1>
           });
         }
 
-        // Dismiss button
         dismissBtn.addEventListener("click", () => {
           localStorage.setItem(DISMISSED_KEY, Date.now().toString());
           banner.classList.remove("visible");
         });
 
-        // Hide if installed later
         window.addEventListener("appinstalled", () => {
           banner.classList.remove("visible");
           deferredPrompt = null;
diff --git a/makeitwork.cloud/sw.js b/makeitwork.cloud/sw.js
index c35afbb..8dbaf2f 100644
--- a/makeitwork.cloud/sw.js
+++ b/makeitwork.cloud/sw.js
@@ -14,7 +14,6 @@ const ASSETS_TO_CACHE = [
   '/Web437_IBM_EGA_8x8.woff'
 ];
 
-// Install: cache core assets
 self.addEventListener('install', (event) => {
   event.waitUntil(
     caches.open(CACHE_NAME).then((cache) => {
@@ -24,7 +23,6 @@ self.addEventListener('install', (event) => {
   self.skipWaiting();
 });
 
-// Activate: clean old caches
 self.addEventListener('activate', (event) => {
   event.waitUntil(
     caches.keys().then((cacheNames) => {
@@ -38,9 +36,8 @@ self.addEventListener('activate', (event) => {
   self.clients.claim();
 });
 
-// Fetch: network-first with cache fallback
+// Network-first with cache fallback.
 self.addEventListener('fetch', (event) => {
-  // Skip non-GET requests
   if (event.request.method !== 'GET') return;
 
   // Skip cross-origin requests (CDN fonts, Font Awesome, etc.)
@@ -49,7 +46,7 @@ self.addEventListener('fetch', (event) => {
   event.respondWith(
     fetch(event.request)
       .then((response) => {
-        // Clone and cache successful responses
+        // Response bodies are consumable, so cloning preserves the original for the caller.
         if (response.ok) {
           const responseClone = response.clone();
           caches.open(CACHE_NAME).then((cache) => {
@@ -59,7 +56,6 @@ self.addEventListener('fetch', (event) => {
         return response;
       })
       .catch(() => {
-        // Fallback to cache on network failure
         return caches.match(event.request);
       })
   );
diff --git a/opencode.json b/opencode.json
index fbfe0c8..db83e07 100644
--- a/opencode.json
+++ b/opencode.json
@@ -35,6 +35,7 @@
     "aws-prod": { "enabled": false },
     "grafana": { "enabled": false },
     "terraform-docs": { "enabled": false },
+    "argocd-makeitwork": { "enabled": false },
     "argocd-staging-eks": { "enabled": false },
     "argocd-prod-eks": { "enabled": false }
   },
@@ -50,6 +51,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": false,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }