diff --git a/.gt-repo.yaml b/.gt-repo.yaml
index 9b2c6b8..21c2b36 100644
--- a/.gt-repo.yaml
+++ b/.gt-repo.yaml
@@ -9,70 +9,23 @@
 # ci-*/cd-* workflow that belongs to this repository: gt creates those once and
 # never touches them again. Branch protection needs exactly one check, ci-gate,
 # which waits on all of them.
+#
+# Only deliberate overrides are written here. Everything absent follows gt's
+# default and keeps following it as that default changes — a value pinned in
+# this file stops tracking gt, which is why sync removes the ones that merely
+# restate it. Run 'gt repo config' to see the resolved spec, defaults included.
 
-gt_version: 1.2.0
+gt_version: 1.3.0
 dependabot:
   - ecosystem: github-actions
     directory: /
   - ecosystem: gomod
     directory: /
-dependabot_auto_merge:
-  enabled: true
-  schedule: 0 1 * * *
-  max_bump: minor
-  delete_branch: true
-  github_app: false
-bulwark:
-  enabled: true
-  coverage: true
 pipeline:
   ci:
-    enabled: true
     stages:
       - preflight
       - build
       - test
-    merge_queue: false
   cd:
     enabled: false
-    stages:
-      - preflight
-      - publish
-      - deploy
-      - verify
-    tags:
-      - v*.*.*
-conventional_commits:
-  enabled: true
-  scope: pr_title
-  types:
-    - feat
-    - fix
-    - docs
-    - style
-    - refactor
-    - perf
-    - test
-    - build
-    - ci
-    - chore
-    - revert
-settings:
-  merge:
-    squash: true
-    merge_commit: false
-    rebase: false
-    delete_branch_on_merge: true
-    squash_title: pr_title
-    squash_message: blank
-  branch_protection:
-    branch: main
-    required_approvals: 0
-    require_up_to_date: false
-    dismiss_stale_reviews: true
-    require_thread_resolution: true
-    require_code_owner_review: false
-    require_last_push_approval: false
-files:
-  - sync
-  - dependabot-auto-merge