diff --git a/specs/shorashim_terumah.md b/specs/shorashim_terumah.md
index 6888d483..f29dfd37 100644
--- a/specs/shorashim_terumah.md
+++ b/specs/shorashim_terumah.md
@@ -68,10 +68,12 @@ All pinned via lock files per Construction Specification §§1.3-1.5.
 | base | 4.18.2.0 | ✅ | Ships with GHC 9.6.4 |
 | containers | 0.6.7 | ✅ | Ships with GHC |
 | text | 2.0.2 | ✅ | Hackage (free) |
-| aeson | 2.2.1.0 | ✅ | Hackage (free) — JSON |
-| vector | 0.13.1.0 | ✅ | Hackage (free) |
-| bytestring | 0.12.1.0 | ✅ | Ships with GHC |
-| hspec | 2.11.7 | ✅ | Hackage (free) — testing |
+| aeson | 2.2.3.0 | ✅ | Hackage (free) — JSON |
+| vector | 0.13.2.0 | ✅ | Hackage (free) |
+| bytestring | 0.12.2.0 | ✅ | Hackage (free) — GHC 9.6.4 ships 0.11.5.3; the freeze pins this one |
+| filepath | 1.4.301.0 | ✅ | Hackage (free) — GHC 9.6.4 ships 1.4.200.1; the freeze pins this one |
+| directory | 1.3.10.1 | ✅ | Hackage (free) — GHC 9.6.4 ships 1.3.8.1; the freeze pins this one |
+| hspec | 2.11.16 | ✅ | Hackage (free) — testing |
 
 ### Erlang (via `rebar.lock`)
 | Package | Version | Status | Notes |
diff --git a/specs/shorashim_vayakhel.md b/specs/shorashim_vayakhel.md
index c0f2b41b..68927940 100644
--- a/specs/shorashim_vayakhel.md
+++ b/specs/shorashim_vayakhel.md
@@ -64,12 +64,12 @@ constraints:
   base ==4.18.2.0,
   containers ==0.6.7,
   text ==2.0.2,
-  aeson ==2.2.1.0,
-  vector ==0.13.1.0,
-  bytestring ==0.12.1.0,
-  filepath ==1.4.200.1,
-  directory ==1.3.8.4,
-  hspec ==2.11.7,
+  aeson ==2.2.3.0,
+  vector ==0.13.2.0,
+  bytestring ==0.12.2.0,
+  filepath ==1.4.301.0,
+  directory ==1.3.10.1,
+  hspec ==2.11.16,
   -- full list in committed freeze file
 ```
 
diff --git a/vav_pipeline/lib/vav_pipeline/doorpost.ex b/vav_pipeline/lib/vav_pipeline/doorpost.ex
index d3fc1ef2..febf3f22 100644
--- a/vav_pipeline/lib/vav_pipeline/doorpost.ex
+++ b/vav_pipeline/lib/vav_pipeline/doorpost.ex
@@ -175,7 +175,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "5094e48ec4158f54646b00e8f2aa9ed57710b4ace33ccba155830a39e3149a38"
+  @expected_hash "39b66c3156d58fee5d0790008db4a542f90ed3007786a7c8b646edeb75e2f80e"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]