From e560cdc94ee4eca4a1c9b9ffb59da719aa18d848 Mon Sep 17 00:00:00 2001
From: Alex English <alex.english80@gmail.com>
Date: Sat, 29 Aug 2026 14:51:50 -0700
Subject: [PATCH 1/2] Pin Terraform to 1.16 in CI

---
 terraform/backend.tf | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/terraform/backend.tf b/terraform/backend.tf
index 6873d98..6977faa 100644
--- a/terraform/backend.tf
+++ b/terraform/backend.tf
@@ -1,5 +1,9 @@
 terraform {
-  required_version = "~> 1.12"
+  # Pins major and minor; patch releases are still picked up. A two-part
+  # constraint like "~> 1.12" allows every 1.x, which is how CI drifted from
+  # 1.12 to 1.16 unnoticed. The dflook plan/apply actions resolve this to the
+  # latest matching release, so this line alone chooses the CI Terraform version.
+  required_version = "~> 1.16.0"
   backend "s3" {
   }
   required_providers {

From 03803314a46f485f1ebd57406185ebc63bccb28c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:53:21 +0000
Subject: [PATCH 2/2] terraform-docs: automated updates to Terraform modules
 README.md [skip ci]

---
 terraform/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/README.md b/terraform/README.md
index 312d9bc..a25b443 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -3,7 +3,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.12 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~> 1.16.0 |
 | <a name="requirement_postgresql"></a> [postgresql](#requirement\_postgresql) | 1.25.0 |
 
 ## Providers