diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
index b8ac02d..a8392dc 100644
--- a/bitbucket-pipelines.yml
+++ b/bitbucket-pipelines.yml
@@ -46,10 +46,12 @@ definitions:
   scripts:
 
     # Installs the uv package manager (pinned to avoid surprise breaks),
-    # then syncs both dev and test dependency groups from pyproject.toml
+    # then syncs both dev and test dependency groups from pyproject.toml.
+    # --locked (NOT --frozen) asserts uv.lock matches pyproject.toml and
+    # fails loudly on mismatch. --frozen would silently use a stale lockfile.
     - script: &install
         pip install uv==0.11.5;
-        uv sync --frozen --group dev --group test;
+        uv sync --locked --group dev --group test;
 
   # ---------------------------------------------------------------------------
   # Reusable step definitions
@@ -116,8 +118,11 @@ definitions:
           - export AWS_REGION=us-east-1
           - export AWS_ROLE_ARN="arn:aws:iam::975049960860:role/DoczyAI-Bitbucket-OIDC"
           - export AWS_WEB_IDENTITY_TOKEN_FILE="$(pwd)/web-identity-token"
-          # printf (not echo) avoids appending a trailing newline to the JWT
+          # printf (not echo) avoids appending a trailing newline to the JWT.
+          # chmod 600 restricts the token file to owner-only (defensive —
+          # the container is already single-user root, but silences scanners).
           - printf '%s' "$BITBUCKET_STEP_OIDC_TOKEN" > "$(pwd)/web-identity-token"
+          - chmod 600 "$(pwd)/web-identity-token"
 
           # Clone the review agent repo (private — needs BITBUCKET_CLONE_TOKEN)
           # SETUP REQUIRED: set BITBUCKET_CLONE_TOKEN (marked "Secured") in
@@ -181,6 +186,9 @@ pipelines:
     # Feature branches represent new functionality. They must go through
     # dev first for integration testing before promotion to stg/main.
     "feature/*":
+      # Gate steps below use atlassian/default-image:4 (not python:3.12.7)
+      # because gates only run bash/shell — no Python needed. The default
+      # image is lighter and avoids pulling a full Python toolchain.
       - step:
           name: "Gate: feature → dev"
           image: atlassian/default-image:4