diff --git a/.github/workflows/example-audit.yml b/.github/workflows/example-audit.yml
index 7325e9f..b3815b8 100644
--- a/.github/workflows/example-audit.yml
+++ b/.github/workflows/example-audit.yml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Start Buildcage builder
         # For self-hosting, replace with: <your-org>/buildcage/setup@<SHA>
-        uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           proxy_mode: audit
 
@@ -53,4 +53,4 @@ jobs:
       - name: Show proxy report
         if: always()
         # For self-hosting, replace with: <your-org>/buildcage/report@<SHA>
-        uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
diff --git a/.github/workflows/example-explicit.yml b/.github/workflows/example-explicit.yml
index e2bef40..a2c7eb9 100644
--- a/.github/workflows/example-explicit.yml
+++ b/.github/workflows/example-explicit.yml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Start Buildcage builder
         # For self-hosting, replace with: <your-org>/buildcage/setup@<SHA>
-        uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           proxy_mode: restrict
           proxy_engine: explicit
@@ -61,6 +61,6 @@ jobs:
       - name: Show proxy report
         if: always()
         # For self-hosting, replace with: <your-org>/buildcage/report@<SHA>
-        uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           fail_on_blocked: false
diff --git a/.github/workflows/example-restrict.yml b/.github/workflows/example-restrict.yml
index d07738d..43a50c7 100644
--- a/.github/workflows/example-restrict.yml
+++ b/.github/workflows/example-restrict.yml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Start Buildcage builder
         # For self-hosting, replace with: <your-org>/buildcage/setup@<SHA>
-        uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           proxy_mode: restrict
           allowed_https_rules: >-
@@ -57,6 +57,6 @@ jobs:
       - name: Show proxy report
         if: always()
         # For self-hosting, replace with: <your-org>/buildcage/report@<SHA>
-        uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           fail_on_blocked: false
diff --git a/.github/workflows/example-run-audit.yml b/.github/workflows/example-run-audit.yml
index f3bb668..f6715b9 100644
--- a/.github/workflows/example-run-audit.yml
+++ b/.github/workflows/example-run-audit.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Discover required domains with the run action
         # For self-hosting, replace with: <your-org>/buildcage/run@<SHA>
-        uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           proxy_mode: audit
           # Audit mode allows and logs every connection instead of blocking any
diff --git a/.github/workflows/example-run.yml b/.github/workflows/example-run.yml
index 9d92275..caecc1a 100644
--- a/.github/workflows/example-run.yml
+++ b/.github/workflows/example-run.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Run tests with outbound network isolation
         # For self-hosting, replace with: <your-org>/buildcage/run@<SHA>
-        uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+        uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
         with:
           proxy_mode: restrict
           allowed_https_rules: >-
diff --git a/README.md b/README.md
index 5a0d71a..573f7f8 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ The walkthrough below covers the full audit → restrict flow.
 ```yaml
 - name: Start Buildcage in audit mode
   id: buildcage
-  uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: audit  # Log everything, enforce no allowlist
 
@@ -56,7 +56,7 @@ The walkthrough below covers the full audit → restrict flow.
 
 - name: Show Buildcage report
   if: always()
-  uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     fail_on_blocked: false  # Don't fail, just show the report
 ```
@@ -78,7 +78,7 @@ Copy these domain names into `allowed_https_rules` or `allowed_http_rules` for S
 ```yaml
 - name: Start Buildcage in restrict mode
   id: buildcage
-  uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: restrict  # Block everything except allowed domains
     allowed_https_rules: >-
@@ -99,7 +99,7 @@ Copy these domain names into `allowed_https_rules` or `allowed_http_rules` for S
 
 - name: Show Buildcage report
   if: always()
-  uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   # Build fails if any unexpected connections were blocked
 ```
 
@@ -191,7 +191,7 @@ experimental — newer and less battle-tested than the `setup`/`report` actions
 
 ```yaml
 - name: Run tests with outbound network isolation
-  uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: restrict
     allowed_https_rules: registry.npmjs.org:443
diff --git a/docs/reference.md b/docs/reference.md
index 63c6ac8..1185007 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -7,7 +7,7 @@ Starts the Buildcage builder container.
 ```yaml
 - name: Start Buildcage builder
   id: buildcage
-  uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: restrict
     allowed_https_rules: >-
@@ -164,7 +164,7 @@ Displays communication logs after builds and optionally fails if any BLOCKED con
 ```yaml
 - name: Show proxy report
   if: always()
-  uses: dash14/buildcage/report@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/report@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
 ```
 
 ### Job Summary
@@ -203,7 +203,7 @@ build.
 
 ```yaml
 - name: Run tests with outbound network isolation
-  uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: restrict
     allowed_https_rules: registry.npmjs.org:443
@@ -248,7 +248,7 @@ Use the step's own `env:` (not a `with:` input) to pass values into `run` — ex
 anything set via `env:` is available there too:
 
 ```yaml
-- uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+- uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   env:
     PR_TITLE: ${{ github.event.pull_request.title }}
   with:
@@ -298,7 +298,7 @@ If `run` needs to write somewhere else — a tool-specific cache directory, for
 under `writable`:
 
 ```yaml
-- uses: dash14/buildcage/run@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+- uses: dash14/buildcage/run@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     writable: |
       /opt/some-tool/cache
diff --git a/docs/rules.md b/docs/rules.md
index ffac1f5..ba37094 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -67,7 +67,7 @@ Since the regex is tested against the `domain:port` string, include a port patte
 
 ```yaml
 - name: Start Buildcage
-  uses: dash14/buildcage/setup@5852b5758679ec16bf63411118c42850ce86d165 # v2.2.2
+  uses: dash14/buildcage/setup@39444cc894f62cc065d088f4a07821179d560f5e # v2.2.3
   with:
     proxy_mode: restrict