diff --git a/.github-gen/velnor-workflow.toml b/.github-gen/velnor-workflow.toml
index d5caeb0..7810cd5 100644
--- a/.github-gen/velnor-workflow.toml
+++ b/.github-gen/velnor-workflow.toml
@@ -2,7 +2,7 @@ schema = 1
 
 [generator]
 repository = "tailrocks/ruxel"
-revision = "2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e"
+revision = "0084d561012199c052fd9eb68393d1fb5a655d7f"
 
 [workflow]
 runners = "both"
diff --git a/.github/ci/.github-actions-generator-state b/.github/ci/.github-actions-generator-state
index 7b45812..e112597 100644
--- a/.github/ci/.github-actions-generator-state
+++ b/.github/ci/.github-actions-generator-state
@@ -1,17 +1,17 @@
 # Generated ownership state; do not edit.
 schema = 2
 [inputs]
-config	eece9636d8fa46f0
+config	64c20eff0b6007fc
 scan	73483f0bc233ebc4
 generator	49
 [outputs]
 .github/actionlint.yaml	ec35f48ae7e90e0e
 .github/ci/project.toml	a0c5060b9b02e82b
-.github/workflows/ci-main.yml	8aa46c3a6833feb5
-.github/workflows/ci-policy.yml	83f0ab3dc9a57b88
-.github/workflows/ci-pr.yml	f94c06af7d9ff22f
-.github/workflows/ci-unit-docker.yml	4ecba3b7f14949cb
-.github/workflows/ci-unit-rust.yml	7f079db16cfe1881
-.github/workflows/maintenance.yml	9a5b2c8498915d04
+.github/workflows/ci-main.yml	2138827604b5fc89
+.github/workflows/ci-policy.yml	0b0f492f4744ad2c
+.github/workflows/ci-pr.yml	b2f82107e862161b
+.github/workflows/ci-unit-docker.yml	eec8417d63e78bcf
+.github/workflows/ci-unit-rust.yml	d25fab96a0690955
+.github/workflows/maintenance.yml	afe9139a6ee8de44
 .github/workflows/nightly.yml	c73d542eaf687a7e
 config/fleet/velnor-host.env	d14b419216449423
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index a573876..b0283dd 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -59,11 +59,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         if: ${{ runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
-          rev: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          rev: 0084d561012199c052fd9eb68393d1fb5a655d7f
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=0084d561012199c052fd9eb68393d1fb5a655d7f" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -80,7 +80,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -98,7 +98,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-0084d561012199c052fd9eb68393d1fb5a655d7f-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
@@ -148,7 +148,7 @@ jobs:
         with:
           backend: github
           version: 1.11.1
-          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-0084d561012199c052fd9eb68393d1fb5a655d7f
           restore-keys: |
             velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-
       - name: Install pinned Velnor workflow runtime
@@ -168,7 +168,7 @@ jobs:
             cargo install \
             --locked \
             --git https://github.com/tailrocks/velnor \
-            --rev 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e \
+            --rev 0084d561012199c052fd9eb68393d1fb5a655d7f \
             --root "$VELNOR_WORKFLOW_ROOT" \
             velnor-workflow \
             --bin velnor-workflow
@@ -190,7 +190,7 @@ jobs:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          VELNOR_WORKFLOW_POLICY_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           velnor-workflow policy \
diff --git a/.github/workflows/ci-policy.yml b/.github/workflows/ci-policy.yml
index 95d8239..36eeb93 100644
--- a/.github/workflows/ci-policy.yml
+++ b/.github/workflows/ci-policy.yml
@@ -51,7 +51,7 @@ jobs:
         with:
           backend: github
           version: 1.11.1
-          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-0084d561012199c052fd9eb68393d1fb5a655d7f
           restore-keys: |
             velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-
       - name: Install pinned Velnor workflow runtime
@@ -71,7 +71,7 @@ jobs:
             cargo install \
             --locked \
             --git https://github.com/tailrocks/velnor \
-            --rev 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e \
+            --rev 0084d561012199c052fd9eb68393d1fb5a655d7f \
             --root "$VELNOR_WORKFLOW_ROOT" \
             velnor-workflow \
             --bin velnor-workflow
@@ -93,7 +93,7 @@ jobs:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          VELNOR_WORKFLOW_POLICY_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           velnor-workflow policy \
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index c69d34e..d39a035 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -58,11 +58,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         if: ${{ runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
-          rev: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          rev: 0084d561012199c052fd9eb68393d1fb5a655d7f
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=0084d561012199c052fd9eb68393d1fb5a655d7f" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -79,7 +79,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -97,7 +97,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-0084d561012199c052fd9eb68393d1fb5a655d7f-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
diff --git a/.github/workflows/ci-unit-docker.yml b/.github/workflows/ci-unit-docker.yml
index 429b40b..3c14b25 100644
--- a/.github/workflows/ci-unit-docker.yml
+++ b/.github/workflows/ci-unit-docker.yml
@@ -124,12 +124,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-0084d561012199c052fd9eb68393d1fb5a655d7f-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -143,7 +143,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
@@ -284,7 +284,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: github
@@ -454,7 +454,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: velnor
diff --git a/.github/workflows/ci-unit-rust.yml b/.github/workflows/ci-unit-rust.yml
index fa92bdc..5fd9376 100644
--- a/.github/workflows/ci-unit-rust.yml
+++ b/.github/workflows/ci-unit-rust.yml
@@ -166,12 +166,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-0084d561012199c052fd9eb68393d1fb5a655d7f-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -185,7 +185,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          EXPECTED_REVISION: 0084d561012199c052fd9eb68393d1fb5a655d7f
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
@@ -483,7 +483,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: github
@@ -675,7 +675,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: velnor
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index 1c448a1..083511d 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -88,12 +88,12 @@ jobs:
           echo "skip=false" >> "$GITHUB_OUTPUT"
       - name: Set up Velnor workflow runtime
         if: ${{ steps.retention-gate.outputs.skip != 'true' && runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@0084d561012199c052fd9eb68393d1fb5a655d7f
         with:
-          rev: 2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e
+          rev: 0084d561012199c052fd9eb68393d1fb5a655d7f
       - name: Set trusted workflow policy revision
         if: steps.retention-gate.outputs.skip != 'true'
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=2ca16370b4a1d67fe9e9ccedbbb0cd6452429d6e" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=0084d561012199c052fd9eb68393d1fb5a655d7f" >> "$GITHUB_ENV"
       - name: Sweep closed-PR merge-ref caches
         if: steps.retention-gate.outputs.skip != 'true'
         env: