diff --git a/.github-gen/velnor-workflow.toml b/.github-gen/velnor-workflow.toml
index 92f4c77..1d410ab 100644
--- a/.github-gen/velnor-workflow.toml
+++ b/.github-gen/velnor-workflow.toml
@@ -1,7 +1,7 @@
 schema = 1
 [generator]
 repository = "tailrocks/graphql-java-datetime"
-revision = "92c3478694ef423fb4160b8c934d6671ca85b51a"
+revision = "b9c3156cdb88e63c11b9e595a3e694b02238c09a"
 [policy]
 ruleset_required_status_checks = ["ci-required"]
 ruleset_external_status_checks = ["DCO"]
diff --git a/.github/ci/.github-actions-generator-state b/.github/ci/.github-actions-generator-state
index 6406888..1ca0787 100644
--- a/.github/ci/.github-actions-generator-state
+++ b/.github/ci/.github-actions-generator-state
@@ -1,16 +1,16 @@
 # Generated ownership state; do not edit.
 schema = 2
 [inputs]
-config	19d7e033150a74a6
+config	28930ca779e6ff5f
 scan	1b72102e5495def6
-generator	48
+generator	49
 [outputs]
 .github/actionlint.yaml	ec35f48ae7e90e0e
 .github/ci/project.toml	b19da7b7165e2f66
-.github/workflows/ci-main.yml	b58e795b73ac20e3
-.github/workflows/ci-policy.yml	8aa45ab903305462
-.github/workflows/ci-pr.yml	8ddc0fe584b9d16a
-.github/workflows/ci-unit-gradle.yml	8f990d0334ceccc0
-.github/workflows/maintenance.yml	12deca93f7bf908c
-.github/workflows/nightly.yml	76e5e2bc12a599c6
+.github/workflows/ci-main.yml	7b55f4df4a234985
+.github/workflows/ci-policy.yml	a9a48676140ac8dd
+.github/workflows/ci-pr.yml	aa0b4d40949af2ad
+.github/workflows/ci-unit-gradle.yml	a8a769d0f75f737d
+.github/workflows/maintenance.yml	44cdcd6db1e77d43
+.github/workflows/nightly.yml	c73d542eaf687a7e
 config/fleet/velnor-host.env	d14b419216449423
diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 0edd709..50105ae 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -58,11 +58,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         if: ${{ runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@92c3478694ef423fb4160b8c934d6671ca85b51a
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@b9c3156cdb88e63c11b9e595a3e694b02238c09a
         with:
-          rev: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          rev: b9c3156cdb88e63c11b9e595a3e694b02238c09a
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=92c3478694ef423fb4160b8c934d6671ca85b51a" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=b9c3156cdb88e63c11b9e595a3e694b02238c09a" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -79,7 +79,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          EXPECTED_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -97,7 +97,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-92c3478694ef423fb4160b8c934d6671ca85b51a-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-b9c3156cdb88e63c11b9e595a3e694b02238c09a-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
@@ -147,7 +147,7 @@ jobs:
         with:
           backend: github
           version: 1.11.1
-          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-92c3478694ef423fb4160b8c934d6671ca85b51a
+          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-b9c3156cdb88e63c11b9e595a3e694b02238c09a
           restore-keys: |
             velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-
       - name: Install pinned Velnor workflow runtime
@@ -167,7 +167,7 @@ jobs:
             cargo install \
             --locked \
             --git https://github.com/tailrocks/velnor \
-            --rev 92c3478694ef423fb4160b8c934d6671ca85b51a \
+            --rev b9c3156cdb88e63c11b9e595a3e694b02238c09a \
             --root "$VELNOR_WORKFLOW_ROOT" \
             velnor-workflow \
             --bin velnor-workflow
@@ -176,20 +176,31 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           DEFAULT_BRANCH: main
+          DECLARED_RULESET_CONTEXTS: DCO,Policy,ci-required
         run: |
           set -euo pipefail
-          contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \
+          stderr="$(mktemp)"
+          trap 'rm -f "$stderr"' EXIT
+          if contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" 2>"$stderr" \
             | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \
             | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \
             | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \
-            | sort -u | paste -sd, -)"
+            | sort -u | paste -sd, -)"; then
+            :
+          elif grep -qE '(HTTP 403|Upgrade to GitHub Team)' "$stderr"; then
+            echo "::warning::rulesets API returned 403; falling back to declared contexts [$DECLARED_RULESET_CONTEXTS]"
+            contexts="$DECLARED_RULESET_CONTEXTS"
+          else
+            cat "$stderr" >&2
+            exit 1
+          fi
           echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV"
       - name: Enforce workflow policy
         env:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          VELNOR_WORKFLOW_POLICY_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           velnor-workflow policy \
diff --git a/.github/workflows/ci-policy.yml b/.github/workflows/ci-policy.yml
index 74138f1..8d15612 100644
--- a/.github/workflows/ci-policy.yml
+++ b/.github/workflows/ci-policy.yml
@@ -51,7 +51,7 @@ jobs:
         with:
           backend: github
           version: 1.11.1
-          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-92c3478694ef423fb4160b8c934d6671ca85b51a
+          cache-key: velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-b9c3156cdb88e63c11b9e595a3e694b02238c09a
           restore-keys: |
             velnor-policy-mbx-1.11.1-${{ runner.os }}-${{ runner.arch }}-
       - name: Install pinned Velnor workflow runtime
@@ -71,7 +71,7 @@ jobs:
             cargo install \
             --locked \
             --git https://github.com/tailrocks/velnor \
-            --rev 92c3478694ef423fb4160b8c934d6671ca85b51a \
+            --rev b9c3156cdb88e63c11b9e595a3e694b02238c09a \
             --root "$VELNOR_WORKFLOW_ROOT" \
             velnor-workflow \
             --bin velnor-workflow
@@ -80,20 +80,31 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           DEFAULT_BRANCH: main
+          DECLARED_RULESET_CONTEXTS: DCO,Policy,ci-required
         run: |
           set -euo pipefail
-          contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \
+          stderr="$(mktemp)"
+          trap 'rm -f "$stderr"' EXIT
+          if contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" 2>"$stderr" \
             | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \
             | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \
             | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \
-            | sort -u | paste -sd, -)"
+            | sort -u | paste -sd, -)"; then
+            :
+          elif grep -qE '(HTTP 403|Upgrade to GitHub Team)' "$stderr"; then
+            echo "::warning::rulesets API returned 403; falling back to declared contexts [$DECLARED_RULESET_CONTEXTS]"
+            contexts="$DECLARED_RULESET_CONTEXTS"
+          else
+            cat "$stderr" >&2
+            exit 1
+          fi
           echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV"
       - name: Enforce workflow policy
         env:
           WORKFLOW_ROOT: ${{ github.workspace }}/policy-checkout
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BASE_SHA: ${{ github.event.pull_request.base.sha || github.sha }}
-          VELNOR_WORKFLOW_POLICY_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          VELNOR_WORKFLOW_POLICY_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           velnor-workflow policy \
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 4d17b3b..9416ad7 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -57,11 +57,11 @@ jobs:
           persist-credentials: false
       - name: Set up Velnor workflow runtime
         if: ${{ runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@92c3478694ef423fb4160b8c934d6671ca85b51a
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@b9c3156cdb88e63c11b9e595a3e694b02238c09a
         with:
-          rev: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          rev: b9c3156cdb88e63c11b9e595a3e694b02238c09a
       - name: Set trusted workflow policy revision
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=92c3478694ef423fb4160b8c934d6671ca85b51a" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=b9c3156cdb88e63c11b9e595a3e694b02238c09a" >> "$GITHUB_ENV"
       - name: Select affected units
         id: plan
         env:
@@ -78,7 +78,7 @@ jobs:
       - name: Prepare Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          EXPECTED_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           stage="$RUNNER_TEMP/velnor-workflow-runtime"
@@ -96,7 +96,7 @@ jobs:
       - name: Publish Velnor workflow runtime
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: velnor-workflow-runtime-92c3478694ef423fb4160b8c934d6671ca85b51a-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-b9c3156cdb88e63c11b9e595a3e694b02238c09a-${{ runner.os }}-${{ runner.arch }}
           path: ${{ runner.temp }}/velnor-workflow-runtime
           if-no-files-found: error
           retention-days: 7
diff --git a/.github/workflows/ci-unit-gradle.yml b/.github/workflows/ci-unit-gradle.yml
index 3bbdde8..903de3b 100644
--- a/.github/workflows/ci-unit-gradle.yml
+++ b/.github/workflows/ci-unit-gradle.yml
@@ -124,12 +124,12 @@ jobs:
       - name: Download Velnor workflow runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: velnor-workflow-runtime-92c3478694ef423fb4160b8c934d6671ca85b51a-${{ runner.os }}-${{ runner.arch }}
+          name: velnor-workflow-runtime-b9c3156cdb88e63c11b9e595a3e694b02238c09a-${{ runner.os }}-${{ runner.arch }}
           path: .velnor-workflow-runtime
       - name: Verify Velnor workflow runtime
         shell: bash
         env:
-          EXPECTED_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          EXPECTED_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           manifest=.velnor-workflow-runtime/manifest.json
@@ -143,7 +143,7 @@ jobs:
       - name: Add Velnor workflow runtime to PATH
         shell: bash
         env:
-          EXPECTED_REVISION: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          EXPECTED_REVISION: b9c3156cdb88e63c11b9e595a3e694b02238c09a
         run: |
           set -euo pipefail
           home="$RUNNER_TEMP/velnor-workflow-runtime-artifact"
@@ -298,7 +298,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: ./.github/actions/report-velnor-ci-outcomes
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@b9c3156cdb88e63c11b9e595a3e694b02238c09a
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: github
@@ -479,7 +479,7 @@ jobs:
           fi
       - name: Report phase timings and cache outcomes
         if: always()
-        uses: ./.github/actions/report-velnor-ci-outcomes
+        uses: tailrocks/velnor/.github/actions/report-velnor-ci-outcomes@b9c3156cdb88e63c11b9e595a3e694b02238c09a
         with:
           job_label: ${{ inputs.unit }}
           ci_lane: velnor
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index 0248dc8..5c5fb60 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -79,7 +79,7 @@ jobs:
         run: |
           set -euo pipefail
           for workflow in ci-main.yml nightly.yml; do
-            if [[ "$(gh run list --workflow "$workflow" --status in_progress --limit 1 --json databaseId --jq 'length')" != "0" ]]; then
+            if [[ "$(gh run list --repo "$GITHUB_REPOSITORY" --workflow "$workflow" --status in_progress --limit 1 --json databaseId --jq 'length')" != "0" ]]; then
               echo "skip=true" >> "$GITHUB_OUTPUT"
               echo "$workflow is in_progress; skipping cache retention" >> "$GITHUB_STEP_SUMMARY"
               exit 0
@@ -88,12 +88,12 @@ jobs:
           echo "skip=false" >> "$GITHUB_OUTPUT"
       - name: Set up Velnor workflow runtime
         if: ${{ steps.retention-gate.outputs.skip != 'true' && runner.environment == 'github-hosted' }}
-        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@92c3478694ef423fb4160b8c934d6671ca85b51a
+        uses: tailrocks/velnor/.github/actions/setup-velnor-workflow@b9c3156cdb88e63c11b9e595a3e694b02238c09a
         with:
-          rev: 92c3478694ef423fb4160b8c934d6671ca85b51a
+          rev: b9c3156cdb88e63c11b9e595a3e694b02238c09a
       - name: Set trusted workflow policy revision
         if: steps.retention-gate.outputs.skip != 'true'
-        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=92c3478694ef423fb4160b8c934d6671ca85b51a" >> "$GITHUB_ENV"
+        run: echo "VELNOR_WORKFLOW_POLICY_REVISION=b9c3156cdb88e63c11b9e595a3e694b02238c09a" >> "$GITHUB_ENV"
       - name: Sweep closed-PR merge-ref caches
         if: steps.retention-gate.outputs.skip != 'true'
         env:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index fb9c849..843b92e 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -57,6 +57,7 @@ jobs:
       - name: Dispatch ci-main on default branch
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
           DEFAULT_BRANCH: main
           DISPATCH_RUNNER: ${{ github.event.inputs.runner || 'both' }}
           DISPATCH_SCOPE: ${{ github.event.inputs.scope || 'full' }}
@@ -65,6 +66,7 @@ jobs:
         run: |
           set -euo pipefail
           gh workflow run ci-main.yml \
+            -R "$GITHUB_REPOSITORY" \
             --ref "$DEFAULT_BRANCH" \
             -f runner="$DISPATCH_RUNNER" \
             -f scope="$DISPATCH_SCOPE" \