diff --git a/CHANGELOG.md b/CHANGELOG.md
index 22c25d99..41d9a3c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## [6.0.0](https://github.com/nullplatform/tofu-modules/compare/v5.3.1...v6.0.0) (2026-07-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* **iam/agent:** clusters that relied on the implicit permissions role must now pass it explicitly in assume_role_arns.
+
+### Features
+
+* **iam/agent:** require explicit assume_role_arns, drop implicit permissions role ([#421](https://github.com/nullplatform/tofu-modules/issues/421)) ([44b8fd6](https://github.com/nullplatform/tofu-modules/commit/44b8fd6d631c1fab3247383728a5d64efea5687f))
+
 ## [5.3.1](https://github.com/nullplatform/tofu-modules/compare/v5.3.0...v5.3.1) (2026-06-29)
 
 
diff --git a/infrastructure/aws/acm/README.md b/infrastructure/aws/acm/README.md
index b1405f83..7fdbab81 100644
--- a/infrastructure/aws/acm/README.md
+++ b/infrastructure/aws/acm/README.md
@@ -18,7 +18,7 @@ The module creates an aws_acm_certificate resource with DNS validation, which is
 
 ```hcl
 module "acm" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/acm?ref=v6.0.0"
 
   domain_name = "your-domain-name"
   zone_id     = "your-zone-id"
diff --git a/infrastructure/aws/aws_load_balancer_controller/README.md b/infrastructure/aws/aws_load_balancer_controller/README.md
index 2fe65651..0509a021 100644
--- a/infrastructure/aws/aws_load_balancer_controller/README.md
+++ b/infrastructure/aws/aws_load_balancer_controller/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the AWS Load Balancer Cont
 
 ```hcl
 module "aws_load_balancer_controller" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/aws_load_balancer_controller?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
   vpc_id       = "your-vpc-id"
diff --git a/infrastructure/aws/backend/README.md b/infrastructure/aws/backend/README.md
index b989ee9a..7635a6ef 100644
--- a/infrastructure/aws/backend/README.md
+++ b/infrastructure/aws/backend/README.md
@@ -20,7 +20,7 @@ This module creates an S3 bucket with versioning and server-side encryption enab
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/backend?ref=v6.0.0"
 }
 ```
 
diff --git a/infrastructure/aws/dns/README.md b/infrastructure/aws/dns/README.md
index c0b8cf6c..44d48d83 100644
--- a/infrastructure/aws/dns/README.md
+++ b/infrastructure/aws/dns/README.md
@@ -21,7 +21,7 @@ The module conditionally creates an aws_route53_zone resource for a public hoste
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/dns?ref=v6.0.0"
 
   domain_name = "your-domain-name"
   vpc_id      = "your-vpc-id"
diff --git a/infrastructure/aws/eks/README.md b/infrastructure/aws/eks/README.md
index 5fc9cd73..137a87dc 100644
--- a/infrastructure/aws/eks/README.md
+++ b/infrastructure/aws/eks/README.md
@@ -22,7 +22,7 @@ The module wraps terraform-aws-modules/eks to create the EKS cluster (aws_eks_cl
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/eks?ref=v6.0.0"
 
   aws_subnets_private_ids = "your-aws-subnets-private-ids"
   aws_vpc_vpc_id          = "your-aws-vpc-vpc-id"
diff --git a/infrastructure/aws/iam/agent/README.md b/infrastructure/aws/iam/agent/README.md
index 3dd48090..417f8b47 100644
--- a/infrastructure/aws/iam/agent/README.md
+++ b/infrastructure/aws/iam/agent/README.md
@@ -2,37 +2,30 @@
 
 ## Description
 
-Creates an IRSA (IAM Roles for Service Accounts) role for a nullplatform agent on EKS, with an assume-role policy allowing the agent to assume the roles explicitly provided by the caller (via assume_role_arns and/or permissions_roles)
+Creates an IRSA (IAM Roles for Service Accounts) role for the nullplatform agent on EKS, with an sts:AssumeRole policy allowing the agent to assume additional permissions roles
 
 ## Architecture
 
-The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-accounts module to create an aws_iam_role with an OIDC trust policy scoped to a specific Kubernetes namespace and service account. An aws_iam_policy (nullplatform_assume_role_policy) is created and attached to the agent role, granting sts:AssumeRole only on the roles the caller supplies: any extra permissions roles created via var.permissions_roles plus any caller-supplied var.assume_role_arns. The module no longer injects any permissions role by naming convention; a lifecycle precondition requires at least one role to be provided. Optionally, one or more aws_iam_role resources (extra_permissions) are created via for_each from var.permissions_roles, each trusting only the agent role ARN, with aws_iam_role_policy_attachment resources wiring the provided policy ARNs to each extra role.
+The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-accounts module to create an aws_iam_role (via the submodule) that trusts the provided OIDC provider ARN scoped to a specific Kubernetes namespace and service account. An aws_iam_policy named nullplatform_assume_role_policy is created and attached to the agent role, granting sts:AssumeRole on all target role ARNs derived from var.assume_role_arns and var.permissions_roles. Optionally, additional aws_iam_role resources are created for each entry in var.permissions_roles, each trusting only the agent role ARN (computed deterministically to avoid circular dependencies), with aws_iam_role_policy_attachment resources binding the specified managed policy ARNs to those roles.
 
 ## Features
 
-- Creates IRSA-enabled aws_iam_role scoped to a specific Kubernetes namespace and service account via OIDC provider trust
-- Creates aws_iam_policy granting sts:AssumeRole only on the role ARNs explicitly supplied by the caller (no implicit permissions role by convention)
-- Requires at least one assumable role (via assume_role_arns or permissions_roles) through a lifecycle precondition
-- Creates optional extra aws_iam_role resources (permissions_roles) trusted exclusively by the agent role with configurable policy attachments
-- Attaches additional caller-supplied policy ARNs directly to the agent role via var.additional_policies
-- Outputs the agent role ARN and a map of extra permissions role ARNs for downstream consumption
-- Derives deterministic role ARNs from account ID and name locals to avoid circular dependencies between role trust and assume policies
+- Creates an IRSA-enabled IAM role scoped to a specific Kubernetes namespace and service account via OIDC provider trust
+- Creates an sts:AssumeRole IAM policy attaching all target role ARNs from both var.assume_role_arns and var.permissions_roles to the agent role
+- Creates additional aws_iam_role resources per var.permissions_roles entry, each trusting only the agent role with configurable managed policy attachments
+- Attaches additional caller-supplied policy ARNs to the agent role via var.additional_policies
+- Supports overriding the agent IAM role name and policy name prefix for multi-cluster deployments
+- Enforces ARN format validation on assume_role_arns and permissions_roles policy ARNs via Terraform variable validations
 
 ## Basic Usage
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/agent?ref=v6.0.0"
 
   agent_namespace                     = "your-agent-namespace"
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"
-
-  # The agent no longer assumes any role by convention. Pass every role it must
-  # assume explicitly, e.g. the k8s permissions role created by the k8s scope module:
-  assume_role_arns = [
-    "arn:aws:iam::123456789012:role/nullplatform-your-cluster-name-agent-permissions-role",
-  ]
 }
 ```
 
@@ -93,16 +86,15 @@ resource "example_resource" "this" {
 <!-- BEGIN_AI_METADATA
 {
   "name": "agent",
-  "description": "Creates an IRSA (IAM Roles for Service Accounts) role for a nullplatform agent on EKS, with an assume-role policy allowing the agent to assume the roles explicitly provided by the caller (via assume_role_arns and/or permissions_roles)",
-  "architecture": "The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-accounts module to create an aws_iam_role with an OIDC trust policy scoped to a specific Kubernetes namespace and service account. An aws_iam_policy (nullplatform_assume_role_policy) is created and attached to the agent role, granting sts:AssumeRole only on the roles the caller supplies: any extra permissions roles created via var.permissions_roles plus any caller-supplied var.assume_role_arns. The module no longer injects any permissions role by naming convention; a lifecycle precondition requires at least one role to be provided. Optionally, one or more aws_iam_role resources (extra_permissions) are created via for_each from var.permissions_roles, each trusting only the agent role ARN, with aws_iam_role_policy_attachment resources wiring the provided policy ARNs to each extra role.",
+  "description": "Creates an IRSA (IAM Roles for Service Accounts) role for the nullplatform agent on EKS, with an sts:AssumeRole policy allowing the agent to assume additional permissions roles",
+  "architecture": "The module uses the terraform-aws-modules/iam//modules/iam-role-for-service-accounts module to create an aws_iam_role (via the submodule) that trusts the provided OIDC provider ARN scoped to a specific Kubernetes namespace and service account. An aws_iam_policy named nullplatform_assume_role_policy is created and attached to the agent role, granting sts:AssumeRole on all target role ARNs derived from var.assume_role_arns and var.permissions_roles. Optionally, additional aws_iam_role resources are created for each entry in var.permissions_roles, each trusting only the agent role ARN (computed deterministically to avoid circular dependencies), with aws_iam_role_policy_attachment resources binding the specified managed policy ARNs to those roles.",
   "features": [
-    "Creates IRSA-enabled aws_iam_role scoped to a specific Kubernetes namespace and service account via OIDC provider trust",
-    "Creates aws_iam_policy granting sts:AssumeRole only on the role ARNs explicitly supplied by the caller (no implicit permissions role by convention)",
-    "Requires at least one assumable role (via assume_role_arns or permissions_roles) through a lifecycle precondition",
-    "Creates optional extra aws_iam_role resources (permissions_roles) trusted exclusively by the agent role with configurable policy attachments",
-    "Attaches additional caller-supplied policy ARNs directly to the agent role via var.additional_policies",
-    "Outputs the agent role ARN and a map of extra permissions role ARNs for downstream consumption",
-    "Derives deterministic role ARNs from account ID and name locals to avoid circular dependencies between role trust and assume policies"
+    "Creates an IRSA-enabled IAM role scoped to a specific Kubernetes namespace and service account via OIDC provider trust",
+    "Creates an sts:AssumeRole IAM policy attaching all target role ARNs from both var.assume_role_arns and var.permissions_roles to the agent role",
+    "Creates additional aws_iam_role resources per var.permissions_roles entry, each trusting only the agent role with configurable managed policy attachments",
+    "Attaches additional caller-supplied policy ARNs to the agent role via var.additional_policies",
+    "Supports overriding the agent IAM role name and policy name prefix for multi-cluster deployments",
+    "Enforces ARN format validation on assume_role_arns and permissions_roles policy ARNs via Terraform variable validations"
   ],
   "inputs": [
     {
@@ -155,6 +147,6 @@ resource "example_resource" "this" {
     "nullplatform_agent_role_arn",
     "nullplatform_agent_extra_permissions_role_arns"
   ],
-  "hash": "080cc2f1402698f5884c98e39f0ef01a"
+  "hash": "88704c22b8d9b0c8ffcd9d22b364c672"
 }
 END_AI_METADATA -->
diff --git a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
index 6e86985c..c2105209 100644
--- a/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
+++ b/infrastructure/aws/iam/aws_load_balancer_controller_iam/README.md
@@ -19,7 +19,7 @@ This module creates an IAM role for the AWS Load Balancer Controller using the t
 
 ```hcl
 module "aws_load_balancer_controller_iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/aws_load_balancer_controller_iam?ref=v6.0.0"
 
   aws_iam_openid_connect_provider_arn = "your-aws-iam-openid-connect-provider-arn"
   cluster_name                        = "your-cluster-name"
diff --git a/infrastructure/aws/iam/cert_manager/README.md b/infrastructure/aws/iam/cert_manager/README.md
index eb415595..6372384b 100644
--- a/infrastructure/aws/iam/cert_manager/README.md
+++ b/infrastructure/aws/iam/cert_manager/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource is always created granting route53:GetChange, route53
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/cert_manager?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ci-build-workflow-user/README.md b/infrastructure/aws/iam/ci-build-workflow-user/README.md
index 86eb2589..37c8252c 100644
--- a/infrastructure/aws/iam/ci-build-workflow-user/README.md
+++ b/infrastructure/aws/iam/ci-build-workflow-user/README.md
@@ -21,7 +21,7 @@ The module creates an aws_iam_user named with the cluster_name prefix and genera
 
 ```hcl
 module "ci-build-workflow-user" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ci-build-workflow-user?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/ecr/README.md b/infrastructure/aws/iam/ecr/README.md
index f08d2b85..a3fbfdab 100644
--- a/infrastructure/aws/iam/ecr/README.md
+++ b/infrastructure/aws/iam/ecr/README.md
@@ -20,7 +20,7 @@ The module creates an aws_iam_role named nullplatform-{cluster_name}-application
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/ecr?ref=v6.0.0"
 
   build_workflow_group_name = "your-build-workflow-group-name"
   cluster_name              = "your-cluster-name"
diff --git a/infrastructure/aws/iam/external_dns/README.md b/infrastructure/aws/iam/external_dns/README.md
index ae73c31c..986d2430 100644
--- a/infrastructure/aws/iam/external_dns/README.md
+++ b/infrastructure/aws/iam/external_dns/README.md
@@ -20,7 +20,7 @@ An aws_iam_policy resource named nullplatform_external_dns_policy is always crea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/external_dns?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/iam/s3-assets/README.md b/infrastructure/aws/iam/s3-assets/README.md
index 432ab3d1..d7c326a4 100644
--- a/infrastructure/aws/iam/s3-assets/README.md
+++ b/infrastructure/aws/iam/s3-assets/README.md
@@ -19,7 +19,7 @@ This module creates an aws_iam_policy resource named with the cluster_name prefi
 
 ```hcl
 module "s3-assets" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3-assets?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/iam/s3-assets?ref=v6.0.0"
 
   assets_bucket             = "your-assets-bucket"
   build_workflow_group_name = "your-build-workflow-group-name"
diff --git a/infrastructure/aws/ingress/README.md b/infrastructure/aws/ingress/README.md
index 249901bc..efd3696b 100644
--- a/infrastructure/aws/ingress/README.md
+++ b/infrastructure/aws/ingress/README.md
@@ -22,7 +22,7 @@ The module creates up to two kubernetes_ingress_v1 resources — one for an inte
 
 ```hcl
 module "ingress" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/ingress?ref=v6.0.0"
 
   certificate_arn = "your-certificate-arn"
 }
diff --git a/infrastructure/aws/security/README.md b/infrastructure/aws/security/README.md
index a9bbfd32..d84950a7 100644
--- a/infrastructure/aws/security/README.md
+++ b/infrastructure/aws/security/README.md
@@ -22,7 +22,7 @@ The module uses data sources (aws_eks_cluster, aws_vpc) to derive VPC ID and CID
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/security?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
 }
diff --git a/infrastructure/aws/vpc/README.md b/infrastructure/aws/vpc/README.md
index 9295fc26..5dce479f 100644
--- a/infrastructure/aws/vpc/README.md
+++ b/infrastructure/aws/vpc/README.md
@@ -22,7 +22,7 @@ This module creates a terraform-aws-modules/vpc/aws module resource with DNS hos
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/aws/vpc?ref=v6.0.0"
 
   account      = "your-account"
   organization = "your-organization"
diff --git a/infrastructure/azure/acr/README.md b/infrastructure/azure/acr/README.md
index 65596cb5..20e27bd3 100644
--- a/infrastructure/azure/acr/README.md
+++ b/infrastructure/azure/acr/README.md
@@ -18,7 +18,7 @@ The module uses the azurerm_container_registry resource to create the container
 
 ```hcl
 module "acr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/acr?ref=v6.0.0"
 
   containerregistry_name = "your-containerregistry-name"
   location               = "your-location"
diff --git a/infrastructure/azure/aks/README.md b/infrastructure/azure/aks/README.md
index 14191326..dec3d201 100644
--- a/infrastructure/azure/aks/README.md
+++ b/infrastructure/azure/aks/README.md
@@ -22,7 +22,7 @@ The module wraps the Azure/aks/azurerm community module (version 11.0.0) and use
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks?ref=v6.0.0"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"
diff --git a/infrastructure/azure/aks_route_table/README.md b/infrastructure/azure/aks_route_table/README.md
index 3644fbca..59eea171 100644
--- a/infrastructure/azure/aks_route_table/README.md
+++ b/infrastructure/azure/aks_route_table/README.md
@@ -19,7 +19,7 @@ The module uses an azurerm_resources data source to discover the route table cre
 
 ```hcl
 module "aks_route_table" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/aks_route_table?ref=v6.0.0"
 
   node_resource_group = "your-node-resource-group"
   subnet_id           = "your-subnet-id"
diff --git a/infrastructure/azure/dns/README.md b/infrastructure/azure/dns/README.md
index 5c272529..7c6ad693 100644
--- a/infrastructure/azure/dns/README.md
+++ b/infrastructure/azure/dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_dns_zone resource and configures it with the prov
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/dns?ref=v6.0.0"
 
   domain_name         = "your-domain-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/iam/README.md b/infrastructure/azure/iam/README.md
index 15684446..edd5e161 100644
--- a/infrastructure/azure/iam/README.md
+++ b/infrastructure/azure/iam/README.md
@@ -21,7 +21,7 @@ The module creates an azurerm_user_assigned_identity resource in the specified r
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/iam?ref=v6.0.0"
 
   location             = "your-location"
   name                 = "your-name"
diff --git a/infrastructure/azure/private_dns/README.md b/infrastructure/azure/private_dns/README.md
index 76da02ba..cf434515 100644
--- a/infrastructure/azure/private_dns/README.md
+++ b/infrastructure/azure/private_dns/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_private_dns_zone resource and optionally multiple
 
 ```hcl
 module "private_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/private_dns?ref=v6.0.0"
 
   domain_name           = "your-domain-name"
   resource_group_name   = "your-resource-group-name"
diff --git a/infrastructure/azure/resource_group/README.md b/infrastructure/azure/resource_group/README.md
index 8571e955..eeb57147 100644
--- a/infrastructure/azure/resource_group/README.md
+++ b/infrastructure/azure/resource_group/README.md
@@ -18,7 +18,7 @@ This module creates an azurerm_resource_group resource and outputs its name and
 
 ```hcl
 module "resource_group" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/resource_group?ref=v6.0.0"
 
   location            = "your-location"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/security/README.md b/infrastructure/azure/security/README.md
index ac33eab6..c328439e 100644
--- a/infrastructure/azure/security/README.md
+++ b/infrastructure/azure/security/README.md
@@ -21,7 +21,7 @@ The module uses azurerm_kubernetes_cluster and azurerm_virtual_network data sour
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/security?ref=v6.0.0"
 
   cluster_name        = "your-cluster-name"
   resource_group_name = "your-resource-group-name"
diff --git a/infrastructure/azure/vnet/README.md b/infrastructure/azure/vnet/README.md
index 55f062b7..8c7a25fe 100644
--- a/infrastructure/azure/vnet/README.md
+++ b/infrastructure/azure/vnet/README.md
@@ -18,7 +18,7 @@ This module creates an Azure virtual network using the azurerm provider and conf
 
 ```hcl
 module "vnet" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/azure/vnet?ref=v6.0.0"
 
   address_space       = "your-address-space"
   location            = "your-location"
diff --git a/infrastructure/commons/cert_manager/README.md b/infrastructure/commons/cert_manager/README.md
index 05be5b02..4fd62c3d 100644
--- a/infrastructure/commons/cert_manager/README.md
+++ b/infrastructure/commons/cert_manager/README.md
@@ -22,7 +22,7 @@ Two primary helm_release resources are created: cert-manager from the Jetstack c
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug        = "your-account-slug"
   cloud_provider      = "your-cloud-provider"
@@ -35,7 +35,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug        = "your-account-slug"
   cloud_provider      = "gcp"
@@ -50,7 +50,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug              = "your-account-slug"
   azure_client_id           = "your-azure-client-id"  # Required when cloud_provider = "azure"
@@ -68,7 +68,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug           = "your-account-slug"
   cloud_provider         = "cloudflare"
@@ -83,7 +83,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug        = "your-account-slug"
   aws_identity_mode   = "your-aws-identity-mode"  # Required when cloud_provider = "aws"
@@ -99,7 +99,7 @@ module "cert_manager" {
 
 ```hcl
 module "cert_manager" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/cert_manager?ref=v6.0.0"
 
   account_slug                       = "your-account-slug"
   cert_manager_webhook_oci_namespace = "your-cert-manager-webhook-oci-namespace"  # Required when cloud_provider = "oci"
diff --git a/infrastructure/commons/external_dns/README.md b/infrastructure/commons/external_dns/README.md
index b464ad0c..70106213 100644
--- a/infrastructure/commons/external_dns/README.md
+++ b/infrastructure/commons/external_dns/README.md
@@ -22,7 +22,7 @@ The module creates an optional kubernetes_namespace_v1 resource and a helm_relea
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   dns_provider_name = "your-dns-provider-name"
   domain_filters    = "your-domain-filters"
@@ -33,7 +33,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   cloudflare_token  = "your-cloudflare-token"  # Required when dns_provider_name = "cloudflare"
   dns_provider_name = "cloudflare"
@@ -45,7 +45,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   aws_iam_role_arn  = "your-aws-iam-role-arn"  # Required when dns_provider_name = "aws"
   aws_identity_mode = "your-aws-identity-mode"  # Required when dns_provider_name = "aws"
@@ -61,7 +61,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   dns_provider_name        = "oci"
   domain_filters           = "your-domain-filters"
@@ -77,7 +77,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure"
@@ -95,7 +95,7 @@ module "external_dns" {
 
 ```hcl
 module "external_dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/external_dns?ref=v6.0.0"
 
   azure_client_id                 = "your-azure-client-id"  # Required when dns_provider_name = "azure-private-dns"
   azure_client_secret             = "your-azure-client-secret"  # Required when dns_provider_name = "azure-private-dns"
diff --git a/infrastructure/commons/istio/README.md b/infrastructure/commons/istio/README.md
index 2ffbd25f..6212907b 100644
--- a/infrastructure/commons/istio/README.md
+++ b/infrastructure/commons/istio/README.md
@@ -21,7 +21,7 @@ Three helm_release resources are created in a strict dependency chain: istio-bas
 
 ```hcl
 module "istio" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/istio?ref=v6.0.0"
 }
 ```
 
diff --git a/infrastructure/commons/prometheus/README.md b/infrastructure/commons/prometheus/README.md
index ce12c57b..125a8192 100644
--- a/infrastructure/commons/prometheus/README.md
+++ b/infrastructure/commons/prometheus/README.md
@@ -18,7 +18,7 @@ This module creates a helm_release resource to deploy the Prometheus chart from
 
 ```hcl
 module "prometheus" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/commons/prometheus?ref=v6.0.0"
 }
 ```
 
diff --git a/infrastructure/gcp/artifact-registry/README.md b/infrastructure/gcp/artifact-registry/README.md
index 3ea12dbb..9ab246d6 100644
--- a/infrastructure/gcp/artifact-registry/README.md
+++ b/infrastructure/gcp/artifact-registry/README.md
@@ -21,7 +21,7 @@ The module provisions a google_artifact_registry_repository resource in the spec
 
 ```hcl
 module "artifact-registry" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/artifact-registry?ref=v6.0.0"
 
   location      = "your-location"
   project_id    = "your-project-id"
diff --git a/infrastructure/gcp/cloud-dns/README.md b/infrastructure/gcp/cloud-dns/README.md
index 5eaf8190..b8f9678d 100644
--- a/infrastructure/gcp/cloud-dns/README.md
+++ b/infrastructure/gcp/cloud-dns/README.md
@@ -21,7 +21,7 @@ The module creates a single google_dns_managed_zone resource in the specified GC
 
 ```hcl
 module "cloud-dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-dns?ref=v6.0.0"
 
   domain_name = "your-domain-name"
   project_id  = "your-project-id"
diff --git a/infrastructure/gcp/cloud-nat/README.md b/infrastructure/gcp/cloud-nat/README.md
index be58025f..53b6cb75 100644
--- a/infrastructure/gcp/cloud-nat/README.md
+++ b/infrastructure/gcp/cloud-nat/README.md
@@ -19,7 +19,7 @@ This module creates a google_compute_router resource in a specified region and n
 
 ```hcl
 module "cloud-nat" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/cloud-nat?ref=v6.0.0"
 
   nat_name    = "your-nat-name"
   network_id  = "your-network-id"
diff --git a/infrastructure/gcp/gke/README.md b/infrastructure/gcp/gke/README.md
index 154bcb80..1eb521fd 100644
--- a/infrastructure/gcp/gke/README.md
+++ b/infrastructure/gcp/gke/README.md
@@ -20,7 +20,7 @@ The module uses the google-modules/kubernetes-engine/google//modules/private-clu
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/gke?ref=v6.0.0"
 
   cluster_name      = "your-cluster-name"
   ip_range_pods     = "your-ip-range-pods"
diff --git a/infrastructure/gcp/iam/README.md b/infrastructure/gcp/iam/README.md
index d893eadd..72e8073c 100644
--- a/infrastructure/gcp/iam/README.md
+++ b/infrastructure/gcp/iam/README.md
@@ -19,7 +19,7 @@ The module creates google_service_account resources for each service account spe
 
 ```hcl
 module "iam" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/iam?ref=v6.0.0"
 
   project_id = "your-project-id"
 }
diff --git a/infrastructure/gcp/security/README.md b/infrastructure/gcp/security/README.md
index 7b2165c2..5d830da3 100644
--- a/infrastructure/gcp/security/README.md
+++ b/infrastructure/gcp/security/README.md
@@ -19,7 +19,7 @@ This module uses Terraform to create GCP firewall rules for public and private I
 
 ```hcl
 module "security" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/security?ref=v6.0.0"
 
   cluster_name   = "your-cluster-name"
   gcp_project_id = "your-gcp-project-id"
diff --git a/infrastructure/gcp/vpc/README.md b/infrastructure/gcp/vpc/README.md
index dce6e086..0cb333c4 100644
--- a/infrastructure/gcp/vpc/README.md
+++ b/infrastructure/gcp/vpc/README.md
@@ -20,7 +20,7 @@ The module invokes the terraform-google-modules/network/google module to create
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/gcp/vpc?ref=v6.0.0"
 
   network_name = "your-network-name"
   project_id   = "your-project-id"
diff --git a/infrastructure/oci/backend/README.md b/infrastructure/oci/backend/README.md
index aa833c2b..7dcc2598 100644
--- a/infrastructure/oci/backend/README.md
+++ b/infrastructure/oci/backend/README.md
@@ -18,7 +18,7 @@ The module creates an oci_objectstorage_bucket resource, which is configured wit
 
 ```hcl
 module "backend" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/backend?ref=v6.0.0"
 
   compartment_id = "your-compartment-id"
   namespace      = "your-namespace"
diff --git a/infrastructure/oci/dns/README.md b/infrastructure/oci/dns/README.md
index de8c6e17..566cc135 100644
--- a/infrastructure/oci/dns/README.md
+++ b/infrastructure/oci/dns/README.md
@@ -18,7 +18,7 @@ This module creates oci_dns_zone resources for each DNS zone defined in the dns_
 
 ```hcl
 module "dns" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dns?ref=v6.0.0"
 
   compartment_id = "your-compartment-id"
 }
diff --git a/infrastructure/oci/dynamic_groups/README.md b/infrastructure/oci/dynamic_groups/README.md
index 6bd38054..da07e23f 100644
--- a/infrastructure/oci/dynamic_groups/README.md
+++ b/infrastructure/oci/dynamic_groups/README.md
@@ -19,7 +19,7 @@ This module creates an OCI dynamic group and an OCI identity policy, connecting
 
 ```hcl
 module "dynamic_groups" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/dynamic_groups?ref=v6.0.0"
 
   cluster_id      = "your-cluster-id"
   compartment_id  = "your-compartment-id"
diff --git a/infrastructure/oci/oke/README.md b/infrastructure/oci/oke/README.md
index efa24128..f6a129a2 100644
--- a/infrastructure/oci/oke/README.md
+++ b/infrastructure/oci/oke/README.md
@@ -21,7 +21,7 @@ The module instantiates the oracle-terraform-modules/oke/oci module to create an
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/oke?ref=v6.0.0"
 
   api_endpoint_subnet_id = "your-api-endpoint-subnet-id"
   cluster_name           = "your-cluster-name"
diff --git a/infrastructure/oci/vcn/README.md b/infrastructure/oci/vcn/README.md
index f11a1021..16b52d86 100644
--- a/infrastructure/oci/vcn/README.md
+++ b/infrastructure/oci/vcn/README.md
@@ -19,7 +19,7 @@ The module instantiates oci_core_subnet resources for public and private subnets
 
 ```hcl
 module "vcn" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//infrastructure/oci/vcn?ref=v6.0.0"
 }
 ```
 
diff --git a/nullplatform/account/README.md b/nullplatform/account/README.md
index f3baf330..b485a7f6 100644
--- a/nullplatform/account/README.md
+++ b/nullplatform/account/README.md
@@ -19,7 +19,7 @@ The module iterates over the `nullplatform_accounts` input map using `for_each`
 
 ```hcl
 module "account" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/account?ref=v6.0.0"
 
   nullplatform_accounts = "your-nullplatform-accounts"
 }
diff --git a/nullplatform/agent/README.md b/nullplatform/agent/README.md
index 39c0205d..2195bdde 100644
--- a/nullplatform/agent/README.md
+++ b/nullplatform/agent/README.md
@@ -22,7 +22,7 @@ The module renders a Helm values file using a templatefile() call that merges de
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.0.0"
 
   api_key        = "your-api-key"
   cloud_provider = "your-cloud-provider"
@@ -37,7 +37,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.0.0"
 
   api_key          = "your-api-key"
   aws_iam_role_arn = "your-aws-iam-role-arn"  # Required when cloud_provider = "aws"
@@ -53,7 +53,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.0.0"
 
   api_key        = "your-api-key"
   cloud_provider = "gcp"
@@ -68,7 +68,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.0.0"
 
   api_key                = "your-api-key"
   azure_client_id        = "your-azure-client-id"  # Required when cloud_provider = "azure"
@@ -91,7 +91,7 @@ module "agent" {
 
 ```hcl
 module "agent" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/agent?ref=v6.0.0"
 
   api_key        = "your-api-key"
   cloud_provider = "oci"
diff --git a/nullplatform/api_key/README.md b/nullplatform/api_key/README.md
index 1225878d..93e0a0a3 100644
--- a/nullplatform/api_key/README.md
+++ b/nullplatform/api_key/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_api_key resource whose name, grants, an
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.0.0"
 
   type = "your-type"
 }
@@ -31,7 +31,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.0.0"
 
   nrn  = "your-nrn"  # Required when type = "agent"
   type = "agent"
@@ -42,7 +42,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.0.0"
 
   nrn                = "your-nrn"  # Required when type = "scope_notification"
   specification_slug = "your-specification-slug"  # Required when type = "scope_notification"
@@ -54,7 +54,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.0.0"
 
   nrn                = "your-nrn"  # Required when type = "service_notification"
   specification_slug = "your-specification-slug"  # Required when type = "service_notification"
@@ -66,7 +66,7 @@ module "api_key" {
 
 ```hcl
 module "api_key" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/api_key?ref=v6.0.0"
 
   custom_grants     = "your-custom-grants"  # Required when type = "custom"
   custom_name       = "your-custom-name"  # Required when type = "custom"
diff --git a/nullplatform/asset/docker_server/README.md b/nullplatform/asset/docker_server/README.md
index e3afbf8d..0568e4f3 100644
--- a/nullplatform/asset/docker_server/README.md
+++ b/nullplatform/asset/docker_server/README.md
@@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource of type 'docker-server' with enc
 
 ```hcl
 module "docker_server" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/docker_server?ref=v6.0.0"
 
   login_server = "your-login-server"
   nrn          = "your-nrn"
diff --git a/nullplatform/asset/ecr/README.md b/nullplatform/asset/ecr/README.md
index ecbc3d85..8bf0e59f 100644
--- a/nullplatform/asset/ecr/README.md
+++ b/nullplatform/asset/ecr/README.md
@@ -21,7 +21,7 @@ The module reads the current AWS region via the aws_region data source and combi
 
 ```hcl
 module "ecr" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/ecr?ref=v6.0.0"
 
   application_role_arn             = "your-application-role-arn"
   build_workflow_access_key_id     = "your-build-workflow-access-key-id"
diff --git a/nullplatform/asset/s3/README.md b/nullplatform/asset/s3/README.md
index 76548f93..4b1a38b3 100644
--- a/nullplatform/asset/s3/README.md
+++ b/nullplatform/asset/s3/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type s3-con
 
 ```hcl
 module "s3" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/asset/s3?ref=v6.0.0"
 
   bucket_name = "your-bucket-name"
   nrn         = "your-nrn"
diff --git a/nullplatform/base/README.md b/nullplatform/base/README.md
index 4f3c9036..c4360bc9 100644
--- a/nullplatform/base/README.md
+++ b/nullplatform/base/README.md
@@ -22,7 +22,7 @@ The module creates two kubernetes_namespace_v1 resources (nullplatform-tools and
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "your-k8s-provider"
   np_api_key   = "your-np-api-key"
@@ -33,7 +33,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "eks"
   np_api_key   = "your-np-api-key"
@@ -44,7 +44,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "gke"
   np_api_key   = "your-np-api-key"
@@ -55,7 +55,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "aks"
   np_api_key   = "your-np-api-key"
@@ -66,7 +66,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "oke"
   np_api_key   = "your-np-api-key"
@@ -77,7 +77,7 @@ module "base" {
 
 ```hcl
 module "base" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/base?ref=v6.0.0"
 
   k8s_provider = "aro"
   np_api_key   = "your-np-api-key"
diff --git a/nullplatform/cloud/aws/cloud/README.md b/nullplatform/cloud/aws/cloud/README.md
index 5a73a5f6..2e541857 100644
--- a/nullplatform/cloud/aws/cloud/README.md
+++ b/nullplatform/cloud/aws/cloud/README.md
@@ -21,7 +21,7 @@ The module uses data sources aws_caller_identity and aws_region to dynamically r
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/cloud?ref=v6.0.0"
 
   domain_name            = "your-domain-name"
   hosted_private_zone_id = "your-hosted-private-zone-id"
diff --git a/nullplatform/cloud/aws/vpc/README.md b/nullplatform/cloud/aws/vpc/README.md
index 5791a573..63931b7d 100644
--- a/nullplatform/cloud/aws/vpc/README.md
+++ b/nullplatform/cloud/aws/vpc/README.md
@@ -20,7 +20,7 @@ Creates a nullplatform_provider_config resource of type 'aws-networking-configur
 
 ```hcl
 module "vpc" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/aws/vpc?ref=v6.0.0"
 
   nrn                 = "your-nrn"
   vpc_id              = "your-vpc-id"
diff --git a/nullplatform/cloud/azure/cloud/README.md b/nullplatform/cloud/azure/cloud/README.md
index f18b5cba..ef7f3155 100644
--- a/nullplatform/cloud/azure/cloud/README.md
+++ b/nullplatform/cloud/azure/cloud/README.md
@@ -22,7 +22,7 @@ The module creates a single nullplatform_provider_config resource of type 'azure
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/azure/cloud?ref=v6.0.0"
 
   azure_resource_group_name       = "your-azure-resource-group-name"
   nrn                             = "your-nrn"
diff --git a/nullplatform/cloud/gcp/cloud/README.md b/nullplatform/cloud/gcp/cloud/README.md
index c420e01a..d75b1690 100644
--- a/nullplatform/cloud/gcp/cloud/README.md
+++ b/nullplatform/cloud/gcp/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'googl
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/gcp/cloud?ref=v6.0.0"
 
   domain_name = "your-domain-name"
   location    = "your-location"
diff --git a/nullplatform/cloud/oci/cloud/README.md b/nullplatform/cloud/oci/cloud/README.md
index 35cd37e7..6c6c94ed 100644
--- a/nullplatform/cloud/oci/cloud/README.md
+++ b/nullplatform/cloud/oci/cloud/README.md
@@ -19,7 +19,7 @@ The module creates a single nullplatform_provider_config resource of type 'oci-c
 
 ```hcl
 module "cloud" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/cloud/oci/cloud?ref=v6.0.0"
 
   account_id       = "your-account-id"
   account_name     = "your-account-name"
diff --git a/nullplatform/code_repository/README.md b/nullplatform/code_repository/README.md
index 50d2893c..c629ba2d 100644
--- a/nullplatform/code_repository/README.md
+++ b/nullplatform/code_repository/README.md
@@ -20,7 +20,7 @@ The module uses local values to evaluate which git provider is selected and cond
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.0.0"
 
   git_provider = "your-git-provider"
   nrn          = "your-nrn"
@@ -31,7 +31,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.0.0"
 
   git_provider           = "github"
   github_installation_id = "your-github-installation-id"  # Required when git_provider = "github"
@@ -44,7 +44,7 @@ module "code_repository" {
 
 ```hcl
 module "code_repository" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/code_repository?ref=v6.0.0"
 
   git_provider             = "gitlab"
   gitlab_access_token      = "your-gitlab-access-token"  # Required when git_provider = "gitlab"
diff --git a/nullplatform/container_orchestration/aks/README.md b/nullplatform/container_orchestration/aks/README.md
index 5191d555..f1bb0a41 100644
--- a/nullplatform/container_orchestration/aks/README.md
+++ b/nullplatform/container_orchestration/aks/README.md
@@ -21,7 +21,7 @@ The module builds a local.attributes map that aggregates cluster metadata, gatew
 
 ```hcl
 module "aks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/aks?ref=v6.0.0"
 
   cluster_name        = "your-cluster-name"
   nrn                 = "your-nrn"
diff --git a/nullplatform/container_orchestration/eks/README.md b/nullplatform/container_orchestration/eks/README.md
index 844200dc..3eea2a81 100644
--- a/nullplatform/container_orchestration/eks/README.md
+++ b/nullplatform/container_orchestration/eks/README.md
@@ -21,7 +21,7 @@ Creates a nullplatform_provider_config resource with type 'eks-configuration' th
 
 ```hcl
 module "eks" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/eks?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
   nrn          = "your-nrn"
diff --git a/nullplatform/container_orchestration/gke/README.md b/nullplatform/container_orchestration/gke/README.md
index fc2319bc..8f12dd24 100644
--- a/nullplatform/container_orchestration/gke/README.md
+++ b/nullplatform/container_orchestration/gke/README.md
@@ -22,7 +22,7 @@ The module constructs a structured attributes object using locals that merge clu
 
 ```hcl
 module "gke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/gke?ref=v6.0.0"
 
   cluster_name        = "your-cluster-name"
   location            = "your-location"
diff --git a/nullplatform/container_orchestration/oke/README.md b/nullplatform/container_orchestration/oke/README.md
index 19726f30..e4c17c2d 100644
--- a/nullplatform/container_orchestration/oke/README.md
+++ b/nullplatform/container_orchestration/oke/README.md
@@ -19,7 +19,7 @@ Creates a single nullplatform_provider_config resource of type 'oke' that stores
 
 ```hcl
 module "oke" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/container_orchestration/oke?ref=v6.0.0"
 
   cluster_name = "your-cluster-name"
   nrn          = "your-nrn"
diff --git a/nullplatform/dimension/README.md b/nullplatform/dimension/README.md
index fa159ba6..ed0af2b6 100644
--- a/nullplatform/dimension/README.md
+++ b/nullplatform/dimension/README.md
@@ -19,7 +19,7 @@ The module creates a nullplatform_dimension resource using the provided name, or
 
 ```hcl
 module "dimension" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension?ref=v6.0.0"
 
   name = "your-name"
   nrn  = "your-nrn"
diff --git a/nullplatform/dimension_value/README.md b/nullplatform/dimension_value/README.md
index 80972d02..fc1c21b3 100644
--- a/nullplatform/dimension_value/README.md
+++ b/nullplatform/dimension_value/README.md
@@ -19,7 +19,7 @@ The module uses a terraform_data resource to enforce mutual-exclusivity and pres
 
 ```hcl
 module "dimension_value" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/dimension_value?ref=v6.0.0"
 
   dimension_id = "your-dimension-id"
   name         = "your-name"
diff --git a/nullplatform/identity-access-control/README.md b/nullplatform/identity-access-control/README.md
index 4bd50df8..38cd928d 100644
--- a/nullplatform/identity-access-control/README.md
+++ b/nullplatform/identity-access-control/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource named identity
 
 ```hcl
 module "identity-access-control" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/identity-access-control?ref=v6.0.0"
 
   attributes = "your-attributes"
   nrn        = "your-nrn"
diff --git a/nullplatform/metrics/README.md b/nullplatform/metrics/README.md
index f3b2a058..5207221f 100644
--- a/nullplatform/metrics/README.md
+++ b/nullplatform/metrics/README.md
@@ -21,7 +21,7 @@ The module creates a single nullplatform_provider_config resource of type 'prome
 
 ```hcl
 module "metrics" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/metrics?ref=v6.0.0"
 
   nrn = "your-nrn"
 }
diff --git a/nullplatform/scope_configuration/README.md b/nullplatform/scope_configuration/README.md
index a5cfb558..d958e2f7 100644
--- a/nullplatform/scope_configuration/README.md
+++ b/nullplatform/scope_configuration/README.md
@@ -20,7 +20,7 @@ The module creates a single nullplatform_provider_config resource that binds a N
 
 ```hcl
 module "scope_configuration" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_configuration?ref=v6.0.0"
 
   attributes                  = "your-attributes"
   np_api_key                  = "your-np-api-key"
diff --git a/nullplatform/scope_definition/README.md b/nullplatform/scope_definition/README.md
index a909da92..fb5ec68c 100644
--- a/nullplatform/scope_definition/README.md
+++ b/nullplatform/scope_definition/README.md
@@ -22,7 +22,7 @@ The module fetches JSON templates via `data.http` resources and processes them t
 
 ```hcl
 module "scope_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition?ref=v6.0.0"
 
   np_api_key = "your-np-api-key"
   nrn        = "your-nrn"
diff --git a/nullplatform/scope_definition_agent_association/README.md b/nullplatform/scope_definition_agent_association/README.md
index dd5f6992..5fa9ba18 100644
--- a/nullplatform/scope_definition_agent_association/README.md
+++ b/nullplatform/scope_definition_agent_association/README.md
@@ -22,7 +22,7 @@ The module fetches a notification channel template via the `data.http` data sour
 
 ```hcl
 module "scope_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/scope_definition_agent_association?ref=v6.0.0"
 
   api_key                  = "your-api-key"
   nrn                      = "your-nrn"
diff --git a/nullplatform/service_definition/README.md b/nullplatform/service_definition/README.md
index facf172f..60aa5b6d 100644
--- a/nullplatform/service_definition/README.md
+++ b/nullplatform/service_definition/README.md
@@ -22,7 +22,7 @@ The module fetches service, action, and link spec templates via the `http` data
 
 ```hcl
 module "service_definition" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition?ref=v6.0.0"
 
   nrn          = "your-nrn"
   service_name = "your-service-name"
diff --git a/nullplatform/service_definition_agent_association/README.md b/nullplatform/service_definition_agent_association/README.md
index 2feddf06..527c6b4f 100644
--- a/nullplatform/service_definition_agent_association/README.md
+++ b/nullplatform/service_definition_agent_association/README.md
@@ -21,7 +21,7 @@ The module creates a terraform_data resource to track API key changes as a lifec
 
 ```hcl
 module "service_definition_agent_association" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/service_definition_agent_association?ref=v6.0.0"
 
   api_key                      = "your-api-key"
   repository_service_spec_repo = "your-repository-service-spec-repo"
diff --git a/nullplatform/users/README.md b/nullplatform/users/README.md
index 146af5bc..747e781e 100644
--- a/nullplatform/users/README.md
+++ b/nullplatform/users/README.md
@@ -21,7 +21,7 @@ The module iterates over a map of user definitions using `nullplatform_user` res
 
 ```hcl
 module "users" {
-  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v5.3.1"
+  source = "git::https://github.com/nullplatform/tofu-modules.git//nullplatform/users?ref=v6.0.0"
 
   nullplatform_users = "your-nullplatform-users"
 }