diff --git a/CLAUDE.md b/CLAUDE.md
index 3259965..4c2d971 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,7 +26,7 @@ APM export (xlsx/csv)
 ```
 
 - **Account / region:** 328440206208 / us-east-1
-- **IaC:** CDK (Python). `aws-cdk-lib` pinned **==2.253.1**. Lambdas Python 3.12, ARM64.
+- **IaC:** CDK (Python). `aws-cdk-lib` pinned **exact** (`==`) in `cdk/requirements.txt`, kept current by Dependabot per the handbook Pinning Principle (no blanket ignores) — don't hardcode a version number here, read the requirements file. Lambdas Python 3.12, ARM64.
 - **No DynamoDB** — deliberate. This is an analytics workload and Grafana cannot query DynamoDB; S3 + Athena is the store. Do not "helpfully" add a table.
 
 ---