diff --git a/.github/workflows/terraform-test.yml b/.github/workflows/terraform-test.yml
index 19c9e1e..36ed705 100644
--- a/.github/workflows/terraform-test.yml
+++ b/.github/workflows/terraform-test.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
         with:
-          terraform_version: "1.15.1"
+          terraform_version: "1.15.4"
           terraform_wrapper: false
 
       - name: Terraform Format Check
diff --git a/docs/how-to/develop-this-module.md b/docs/how-to/develop-this-module.md
index 1f9954d..f4613c1 100644
--- a/docs/how-to/develop-this-module.md
+++ b/docs/how-to/develop-this-module.md
@@ -4,7 +4,7 @@
 
 Install the same pinned tools used by CI:
 
-- Terraform 1.15.1
+- Terraform 1.15.4
 - TFLint 0.59.1
 - terraform-docs 0.20.0
 - OPA 1.10.0
diff --git a/docs/reference/terraform.md b/docs/reference/terraform.md
index a846cdd..807ac90 100644
--- a/docs/reference/terraform.md
+++ b/docs/reference/terraform.md
@@ -7,7 +7,7 @@ This file is overwritten by `terraform-docs` on every PR via the
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [github_actions_environment_secret.env_secret](https://registry.terraform.io/providers/integrations/github/6.10.2/docs/resources/actions_environment_secret) | resource |
 | [github_actions_environment_variable.env_var](https://registry.terraform.io/providers/integrations/github/6.10.2/docs/resources/actions_environment_variable) | resource |
 | [github_actions_repository_permissions.actions](https://registry.terraform.io/providers/integrations/github/6.10.2/docs/resources/actions_repository_permissions) | resource |
@@ -25,7 +25,7 @@ This file is overwritten by `terraform-docs` on every PR via the
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | github\_app\_auth | GitHub App authentication config. Required when github\_auth\_mode = 'app'. Must be null when github\_auth\_mode = 'token'. pem\_file accepts PEM contents as a string. | <pre>object({<br/>    id              = string<br/>    installation_id = string<br/>    pem_file        = string<br/>  })</pre> | `null` | no |
 | github\_auth\_mode | Provider authentication mode. Must be either 'app' (GitHub App installation, preferred) or 'token' (classic or fine-grained PAT, break-glass only). | `string` | `"token"` | no |
 | github\_is\_organization | Whether the github\_owner is an organization (true) or personal account (false). Controls org-only features and CODEOWNERS synthesis behavior. | `bool` | `false` | no |
@@ -43,7 +43,7 @@ This file is overwritten by `terraform-docs` on every PR via the
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | all\_repositories | Computed repository map. Non-sensitive so terraform test assertions can inspect normalized values. |
 | branch\_rulesets | Computed branch rulesets map. Non-sensitive so terraform test assertions can inspect ruleset counts and values. |
 | locals\_debug | All computed locals for debugging. Marked sensitive to prevent exposure in CI/CD logs. |
diff --git a/terraform/versions.tf b/terraform/versions.tf
index bbcd5d6..17921e2 100644
--- a/terraform/versions.tf
+++ b/terraform/versions.tf
@@ -1,6 +1,6 @@
 terraform {
   # Pin Terraform exactly per org ADR 0005.
-  required_version = "= 1.15.1"
+  required_version = "= 1.15.4"
 
   required_providers {
     github = {