diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index 61e8476..0390347 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -64,24 +64,23 @@ provider "registry.terraform.io/hashicorp/random" {
 }
 
 provider "registry.terraform.io/integrations/github" {
-  version     = "6.7.3"
-  constraints = "~> 6.6, ~> 6.7, >= 6.7.3, 6.7.3"
+  version     = "6.12.1"
+  constraints = "~> 6.6, ~> 6.7, != 6.7.3"
   hashes = [
-    "h1:Jwdu/dDXKwrwLFn6RgnjItp4q3DNHKHPOvxQ6rGmPQE=",
-    "zh:13686ba2e4e86070a51902b07503c0b3f9d3d3a77ea9ca4487dad68bc9f51e15",
-    "zh:268180ca9ff7d10046d7b49b30de0e7a35074090995160d5732a9d20336d0c73",
-    "zh:407b43ca464b199ccd522a9948097f8d90fedc58175bd350747723545c66974b",
-    "zh:6296ecb946806db0a562604deff3f9fb5a0c4734d680343ed295724c83e8fa2d",
-    "zh:840bcd0c179c9af82e543af6792c2fd4f4c3ef508667fe8e53b1ea6a32ffa34d",
-    "zh:a9baa336fce1ab1531e1236178c6c1ac3d20bb9d155c5275f1db4261d2f5f7a8",
-    "zh:aac75eea9bd55a492ab0624675e9a1894b1b1651ab0315e72e05856fd86a0f79",
-    "zh:b1016867d89ca96b5815653a1b63065a06f355417c359052c1cbc7ecaff3dc53",
-    "zh:b186c3c1a085362fe129be696253b1285c308cccff4f9781607747c3f378ee6f",
-    "zh:b566693f88940fe26064e0ba714305c2d34bda2a79ca914653527ea262989870",
-    "zh:bcbbd2cb484e18b92e0ce0cbadac5cc3cc0dc96abdab900bf0605de478d0915d",
-    "zh:cafe39d22a3d78abdf6e50c296757c3ae6a39a4a59040d376e3a0797e08d4117",
-    "zh:de8e8386b7fa9e1eecc2b3d7fccfe93d84c015a5d4d2c1e8cc78d57b7c4cd04b",
-    "zh:e237e8216575713322a9cc2172535e0fcd4a91368da5ef94e923bd7f02d3594f",
+    "h1:hHOwf554tYL9pQS2uRPbaAGSXRbbBJ/+HtQAoT9mtuA=",
+    "zh:3e1a4081ecb9518fdf0074db83c16ad00dc81ffe8249a6e3cf1894e947e28df6",
+    "zh:4cb8224b7f530795b674ac044675f6b22a7c9154f55eb9f76c5af6c7534056a4",
+    "zh:560bc08637926191f6871a89e986022ca67c70afda5bebca34b5216e6fac69c9",
+    "zh:5a70b5d2ac650c5c9819a1875411ebda229d0fcc6c9f57f9d751852ca3cd77ac",
+    "zh:8668d93bd4dc2ffa2545e1473af600a925d479b16033a71a4498a16f3b683c0c",
+    "zh:86eacc6059fd057948e178b665ba5cce74bd5488a9e1035734e60ff5ef1b6f8f",
+    "zh:a329fac98881d8dfc211a9bdc0ec6f2948f0b0c2704d1b6cbe5307403c7ad1b2",
+    "zh:dadd44abab3c52b9d572955afaef1658790e17ea355ee22b58996d81d28e02d8",
+    "zh:de9f455ef342cc38fb76bce844bfcd376fb81a4b9f9bc2fae023ff99efdf1338",
+    "zh:f8c6d2e8351b334491790358574e0a30a7c6d7f5b80f7daf32a7c0f3e9b1ab19",
+    "zh:fab41971a3edee04ab6eceaeab4eeb9a2b2f38a2af3b06eda93e2117b64994be",
+    "zh:fb1279b566dd9c8c117b2e4e0cc8344413b8fc8f2a3e24be22a9b2610551777b",
     "zh:fbd1fee2c9df3aa19cf8851ce134dea6e45ea01cb85695c1726670c285797e25",
+    "zh:fe79d2a861fb9af420fa5bd7f02c031b2a0a3edf5dbc46022c8ecc7a33cf2b6d",
   ]
 }
diff --git a/hooks/pre-commit b/hooks/pre-commit
old mode 100644
new mode 100755
diff --git a/modules/service-repo/main.tf b/modules/service-repo/main.tf
index 6812204..ecd684d 100644
--- a/modules/service-repo/main.tf
+++ b/modules/service-repo/main.tf
@@ -28,8 +28,8 @@ resource "github_repository" "this" {
   web_commit_signoff_required = false
 
   template {
-    owner      = var.gh_org_name
-    repository = var.template_repo
+    owner      = "infrahouse"
+    repository = "terraform-root-template"
   }
 }
 
diff --git a/modules/service-repo/terraform.tf b/modules/service-repo/terraform.tf
index 3499a8b..04cb1ad 100644
--- a/modules/service-repo/terraform.tf
+++ b/modules/service-repo/terraform.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     github = {
       source  = "integrations/github"
-      version = "~> 6.7, >= 6.7.3"
+      version = "~> 6.7"
     }
     random = {
       source = "hashicorp/random"
diff --git a/modules/service-repo/variables.tf b/modules/service-repo/variables.tf
index 561d0c5..483b4bb 100644
--- a/modules/service-repo/variables.tf
+++ b/modules/service-repo/variables.tf
@@ -101,18 +101,12 @@ variable "state_bucket" {
   type        = string
 }
 
-variable "template_repo" {
+variable "repo_private" {
   description = <<-EOT
-    Name of the template repository to use when creating the service repo.
-    The template provides CI/CD workflows, Makefile, .gitignore, and other
-    boilerplate. Files are copied once at creation time — the service repo
-    owns them after that.
+    If true, the repository is private.
+    Rulesets and environments on private repos require a GitHub Team
+    plan ($4/user/month).
   EOT
-  type        = string
-}
-
-variable "repo_private" {
-  description = "If true, the repository is private."
   type        = bool
   default     = true
 }
diff --git a/repo-aws-service-infrahouse-app.tf b/repo-aws-service-infrahouse-app.tf
index 153e6cd..17620fc 100644
--- a/repo-aws-service-infrahouse-app.tf
+++ b/repo-aws-service-infrahouse-app.tf
@@ -37,7 +37,6 @@ module "aws_service_infrahouse_app" {
   repo_description = "AWS infrastructure for the InfraHouse product app"
   gh_org_name      = local.gh_org_name
   github_app_slug  = "infrahouse-github-terraform"
-  template_repo    = "terraform-root-template"
   state_bucket     = module.aws_service_infrahouse_app_state.bucket_name
 
   environments = {
diff --git a/repos.tf b/repos.tf
old mode 100755
new mode 100644
diff --git a/terraform.tf b/terraform.tf
index 5689be1..b53cdf2 100644
--- a/terraform.tf
+++ b/terraform.tf
@@ -12,8 +12,11 @@ terraform {
 
   required_providers {
     github = {
-      source  = "integrations/github"
-      version = "6.7.3"
+      source = "integrations/github"
+      # 6.7.3 causes "Root object was present, but now absent"
+      # on github_actions_secret due to destroy_on_drift bug.
+      # https://github.com/integrations/terraform-provider-github/issues/2387
+      version = "~> 6.7, != 6.7.3"
     }
     aws = {
       source  = "hashicorp/aws"