diff --git a/.github/actions/zipx-sbt-setup/action.yml b/.github/actions/zipx-sbt-setup/action.yml
index 3b1c1a7..6708935 100644
--- a/.github/actions/zipx-sbt-setup/action.yml
+++ b/.github/actions/zipx-sbt-setup/action.yml
@@ -70,7 +70,7 @@ runs:
           epoch="$release"
         elif tag=$(git describe --tags --abbrev=0 --match "$tag_match" 2>/dev/null); then
           release="${tag#v}"
-          epoch="${release}-ci"
+          epoch="${release}-SNAPSHOT"
         else
           echo "::warning title=zipx cache epoch::No tags matching '$tag_match' found; using epoch 0.0.0."
           release="0.0.0"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ae8745..cc63283 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,7 @@ jobs:
       contents: read
       pull-requests: read
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     outputs:
       run: ${{ steps.check.outputs.run }}
@@ -62,6 +63,7 @@ jobs:
       - verify-gate
     if: needs.verify-gate.result == 'success' && needs.verify-gate.outputs.run == 'false'
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -87,6 +89,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,6 +106,8 @@ jobs:
           sbt-disk-cache: "false"
           cache-mode: save
           cache-epoch: ""
+      - name: Pinned snapshots
+        run: echo "::warning title=zipx snapshots::pinned snapshots (rocks.earlyeffect:sbt-zipx:0.17.0-SNAPSHOT)"
       - name: test
         run: |
           if [ "$ZIPX_VERIFY_CLEAN_FULL" = "true" ]; then
@@ -119,6 +124,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -151,6 +157,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -183,6 +190,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -215,6 +223,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -247,6 +256,7 @@ jobs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -279,6 +289,7 @@ jobs:
     runs-on: ubuntu-latest
     if: (startsWith(github.ref, 'refs/tags/v')) && (github.repository == 'early-effect/hexis')
     env:
+      COURSIER_TTL: "0s"
       JAVA_OPTS: -Xms2048M -Xmx2048M -Xss6M -XX:ReservedCodeCacheSize=256M -Dfile.encoding=UTF-8
       PGP_KEY_HEX: ${{ secrets.PGP_KEY_HEX }}
       PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
diff --git a/project/ZipxVersions.scala b/project/ZipxVersions.scala
index 3e01692..8a05def 100644
--- a/project/ZipxVersions.scala
+++ b/project/ZipxVersions.scala
@@ -5,7 +5,7 @@ import zipx.*
 
 /** Typed catalog. `zipxDepUpdate` rewrites constructors here. sbt-zipx and sbt-pgp are not rows. */
 object MyVersions extends ZipxVersions:
-  val sbt: SbtVersion     = SbtVersion("2.1.0-M2")
+  val sbt: SbtVersion     = SbtVersion("2.1.0-M3")
   val scala: ScalaVersion = ScalaVersion("3.9.0")
 
   val zio        = Lib("dev.zio", "zio", "2.1.26")
diff --git a/project/build.properties b/project/build.properties
index 3604e52..3e1457f 100644
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-sbt.version=2.1.0-M2
+sbt.version=2.1.0-M3
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 9eb18ab..c29b144 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,5 +1,7 @@
 // Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.13.0")
+resolvers += "central-snapshots" at "https://central.sonatype.com/repository/maven-snapshots/"
+forceUpdatePeriod := Some(scala.concurrent.duration.Duration.Zero)
+addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.17.0-SNAPSHOT")
 addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.6.2")
 addSbtPlugin("com.github.sbt" % "sbt-dynver" % "5.1.1")
 addSbtPlugin("org.scala-js" % "sbt-scalajs" % "1.22.0")
diff --git a/project/zipx-ci.env b/project/zipx-ci.env
index 2bf592c..01719ab 100644
--- a/project/zipx-ci.env
+++ b/project/zipx-ci.env
@@ -1,4 +1,3 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
 ZIPX_JAVA_VERSION=25
 ZIPX_RUNNER_OS=ubuntu-latest
-ZIPX_CLI_VERSION=0.13.0