diff --git a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
index af94235..74836e6 100644
--- a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
+++ b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
@@ -49,12 +49,12 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 1cdc18f75f7e
+      commit: abed4360d495
       files:
       - path: bounded-executor/executor.py
         sha256: d724f4f831640c92b8b542dd2adab2e77f40d87d88f46d9482bff9fdcc4f6c70
       - path: bounded-executor/operations.py
-        sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13
+        sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084
       - path: sso-mfa/k8s/synthetic-journey/journey.py
         sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
     steps:
@@ -151,30 +151,30 @@ spec:
         scope: k8s/sso/deployment/authelia
       checks_after:
       - synthetic-journey
-  plan_digest: sha256:4d9dee9c88fe49fee1b93f462ccf00bdfa9fa3c197ac0400998792b91992843f
+  plan_digest: sha256:9dadc34d8186937d98bd6dd6ed5858d4fbcabda45359838bb2c2378237443502
   checks:
   - id: kv-advanced
     description: KV svc-authelia has exactly one new version, CAS on the previous one
     ref: bounded-executor/operations.py
-    sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13
+    sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084
     timeout_seconds: 30
     expect: pass
   - id: bind-signs-in
     description: the new KV value signs in to LLDAP as svc-authelia
     ref: bounded-executor/operations.py
-    sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13
+    sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084
     timeout_seconds: 30
     expect: pass
   - id: eso-synced
     description: the ExternalSecret is Ready with a refresh after the step started; the executor never reads the Secret
     ref: bounded-executor/operations.py
-    sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13
+    sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084
     timeout_seconds: 120
     expect: pass
   - id: synthetic-journey
     description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2
     ref: bounded-executor/operations.py
-    sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13
+    sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084
     timeout_seconds: 90
     expect: pass
   stop_and_revert:
diff --git a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml
index d97b116..2e0e9cc 100644
--- a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml
+++ b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml
@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 1cdc18f75f7e
+      commit: abed4360d495
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -97,7 +97,7 @@ spec:
         scope: openbao/platform/workloads/net-kingdom/directory-binds
       checks_after:
       - accounts-sign-in
-  plan_digest: sha256:775ea5a7f0bdef09112c9646bd473931551be0911b70901ab607c424587595a5
+  plan_digest: sha256:23dcb8d6f356c5183affa05f149825579ccc2c078a2efd82795caad26384b414
   checks:
   - id: accounts-read-only
     description: each account exists in lldap_strict_readonly only and cannot write
diff --git a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml
index 9f5709d..26e08c8 100644
--- a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml
+++ b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml
@@ -46,7 +46,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 1cdc18f75f7e
+      commit: abed4360d495
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -73,7 +73,7 @@ spec:
         scope: k8s/sso
       checks_after:
       - split-shape
-  plan_digest: sha256:2e31c9dfdccd4e3d6320dd0616ae778df94438ea4a64e602a12781da9ad9dcc3
+  plan_digest: sha256:673d9614f1c347c8015fb3b1d42e122c855f58323d403b78a934a807656d7fa8
   checks:
   - id: split-shape
     description: every consumer binds as its own svc- account; no service binds as admin
diff --git a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml
index 6f3c17f..19243fe 100644
--- a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml
+++ b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml
@@ -43,7 +43,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 1cdc18f75f7e
+      commit: abed4360d495
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -97,7 +97,7 @@ spec:
         scope: k8s/sso/deployment/lldap
       checks_after:
       - synthetic-journey
-  plan_digest: sha256:fb8c00c3cd580b365cd9ce49fb952c861e92fb6bcf0102b37c2bc7620da3899d
+  plan_digest: sha256:cd134501fa62b18b54b9b0d1ec6ab9acd35556c995813e8487223189482cc196
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership
diff --git a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml
index 811ebc7..5467ceb 100644
--- a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml
+++ b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml
@@ -42,7 +42,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 1cdc18f75f7e
+      commit: abed4360d495
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -108,7 +108,7 @@ spec:
         scope: k8s/sso/deployment/lldap
       checks_after:
       - synthetic-journey
-  plan_digest: sha256:20b40b06bae8386877f24eb2450e9582c041e198802bd0356b12113d4b5c9660
+  plan_digest: sha256:860c7a7cf8478a096190312ae303c4403ec483372274a28471c2f74677a68f63
   checks:
   - id: ld-admin-administers
     description: ld-admin signs in and administers; admin keeps lldap_admin membership