diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 3ba236d..42d98e9 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -26,3 +26,13 @@ permissions:
 jobs:
   auto-merge:
     uses: pedromvgomes/gt/.github/workflows/reusable-dependabot-auto-merge.yml@v1
+    # Named, not inherited: `secrets: inherit` is documented as working for
+    # reusable workflows "in the same organization or enterprise", and gt lives
+    # under a different owner than the repositories calling it. The bulwark
+    # stage lost its Codecov token to exactly that, silently.
+    #
+    # Both are optional and resolve to the empty string where the organization
+    # has no bot App, which the called workflow treats as "not configured".
+    secrets:
+      APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.gt-repo.yaml b/.gt-repo.yaml
index c93148a..d08c9b0 100644
--- a/.gt-repo.yaml
+++ b/.gt-repo.yaml
@@ -9,8 +9,13 @@
 # ci-*/cd-* workflow that belongs to this repository: gt creates those once and
 # never touches them again. Branch protection needs exactly one check, ci-gate,
 # which waits on all of them.
+#
+# Only deliberate overrides are written here. Everything absent follows gt's
+# default and keeps following it as that default changes — a value pinned in
+# this file stops tracking gt, which is why sync removes the ones that merely
+# restate it. Run 'gt repo config' to see the resolved spec, defaults included.
 
-gt_version: 1.0.0
+gt_version: 1.3.0
 dependabot:
   - ecosystem: github-actions
     directory: /
@@ -26,61 +31,11 @@ dependabot:
 
       Fix on such a PR with:
         yarn --cwd web build && cp web/dist/index.html internal/dashboard/assets/index.html
-dependabot_auto_merge:
-  enabled: true
-  schedule: 0 1 * * *
-  max_bump: minor
-  delete_branch: true
-bulwark:
-  enabled: true
 pipeline:
   ci:
-    enabled: true
     stages:
       - preflight
       - build
       - test
-    merge_queue: false
   cd:
     enabled: false
-    stages:
-      - preflight
-      - publish
-      - deploy
-      - verify
-    tags:
-      - v*.*.*
-conventional_commits:
-  enabled: true
-  scope: pr_title
-  types:
-    - feat
-    - fix
-    - docs
-    - style
-    - refactor
-    - perf
-    - test
-    - build
-    - ci
-    - chore
-    - revert
-settings:
-  merge:
-    squash: true
-    merge_commit: false
-    rebase: false
-    delete_branch_on_merge: true
-    squash_title: pr_title
-    squash_message: blank
-  branch_protection:
-    branch: main
-    required_approvals: 0
-    require_up_to_date: false
-    dismiss_stale_reviews: true
-    require_thread_resolution: true
-    require_code_owner_review: false
-    require_last_push_approval: false
-files:
-  - sync
-  - dependabot-auto-merge