diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4841ebe..42403b4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -3,6 +3,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 2cd8119..42002bb 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -1,6 +1,10 @@
 name: Dependency Review
 on:
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   review:
     uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
diff --git a/bin/app.ts b/bin/app.ts
index 7618767..18b4194 100644
--- a/bin/app.ts
+++ b/bin/app.ts
@@ -228,4 +228,4 @@ const backupPrimary = new BackupStack(app, "backup", {
   env: { account: "328440206208", region: "us-east-1" },
 });
 
-backupPrimary.addDependency(backupOffsite);
+backupPrimary.addStackDependency(backupOffsite);
diff --git a/lib/backup-stack.ts b/lib/backup-stack.ts
index a18f28b..763f322 100644
--- a/lib/backup-stack.ts
+++ b/lib/backup-stack.ts
@@ -163,7 +163,7 @@ export class BackupStack extends cdk.Stack {
 
     // Cross-region copy destination, referenced by literal ARN (the offsite
     // stack is in another region; a literal ARN avoids crossRegionReferences /
-    // SSM exports). Stack ordering is enforced via addDependency in bin/app.ts.
+    // SSM exports). Stack ordering is enforced via addStackDependency in bin/app.ts.
     const offsiteVault = backup.BackupVault.fromBackupVaultArn(
       this,
       "OffsiteVaultRef",
diff --git a/package-lock.json b/package-lock.json
index c526c5b..96494f8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "dependencies": {
         "aws-cdk-lib": "2.262.0",
-        "constructs": "^10.0.0"
+        "constructs": "^10.7.0"
       },
       "bin": {
         "app": "bin/app.js"
@@ -17,9 +17,9 @@
       "devDependencies": {
         "@types/node": "^24.13.3",
         "@types/source-map-support": "^0.5.10",
-        "aws-cdk": "^2.1130.0",
+        "aws-cdk": "^2.1132.0",
         "source-map-support": "^0.5.21",
-        "tsx": "4.23.0",
+        "tsx": "4.23.1",
         "typescript": "~7.0.2"
       }
     },
@@ -874,9 +874,9 @@
       }
     },
     "node_modules/aws-cdk": {
-      "version": "2.1130.0",
-      "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1130.0.tgz",
-      "integrity": "sha512-LgSKHFTGhoT/lML48uiYIpdSHCwZLvUx/uZu5MqcZjh+OwWzM8nCxXY+OjKG3yASlx5JxeulXm4sRaUYo48qFQ==",
+      "version": "2.1132.0",
+      "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1132.0.tgz",
+      "integrity": "sha512-kcIzBZQO+2v+F97iaeI29fdOUQEx44wr0qDb9HXNqdU82V+1ZKI1KuFlHwH2nq7+6iNc1bu60se4hFf+2d7vXg==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -1106,9 +1106,9 @@
       "license": "MIT"
     },
     "node_modules/constructs": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/constructs/-/constructs-10.6.0.tgz",
-      "integrity": "sha512-TxHOnBO5zMo/G76ykzGF/wMpEHu257TbWiIxP9K0Yv/+t70UzgBQiTqjkAsWOPC6jW91DzJI0+ehQV6xDRNBuQ==",
+      "version": "10.7.0",
+      "resolved": "https://registry.npmjs.org/constructs/-/constructs-10.7.0.tgz",
+      "integrity": "sha512-Vzwc30bMywc7DCzX8XOyuZbsBmfXTCrn6HHmhhELZK1J5dnUWwJ5uL7hBXGGq7xFPVOOO6cs9FwaxOshAxgcWQ==",
       "license": "Apache-2.0"
     },
     "node_modules/esbuild": {
@@ -1190,9 +1190,9 @@
       }
     },
     "node_modules/tsx": {
-      "version": "4.23.0",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz",
-      "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==",
+      "version": "4.23.1",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz",
+      "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index 2e34a4b..72bfc25 100644
--- a/package.json
+++ b/package.json
@@ -14,13 +14,13 @@
   "devDependencies": {
     "@types/node": "^24.13.3",
     "@types/source-map-support": "^0.5.10",
-    "aws-cdk": "^2.1130.0",
+    "aws-cdk": "^2.1132.0",
     "source-map-support": "^0.5.21",
-    "tsx": "4.23.0",
+    "tsx": "4.23.1",
     "typescript": "~7.0.2"
   },
   "dependencies": {
     "aws-cdk-lib": "2.262.0",
-    "constructs": "^10.0.0"
+    "constructs": "^10.7.0"
   }
 }
diff --git a/scripts/iam-user-delete.sh b/scripts/iam-user-delete.sh
index dbd80a2..fa9bfed 100755
--- a/scripts/iam-user-delete.sh
+++ b/scripts/iam-user-delete.sh
@@ -13,7 +13,7 @@
 #   scripts/iam-user-delete.sh [--profile NAME] [--yes] USER [USER ...]
 #
 #   --profile NAME   AWS CLI profile (default: $AWS_PROFILE or the default chain).
-#                    Post-SSO-cutover this is normally `amoussa-seahaven`.
+#                    Post-SSO-cutover this is normally `seahaven-mgmt`.
 #   --yes            Skip the per-user confirmation prompt.
 #
 # Safety: