diff --git a/README.md b/README.md
index 04fddab..8336ea7 100644
--- a/README.md
+++ b/README.md
@@ -108,10 +108,10 @@ Deterministic deployment:
 
 - Set `ESCROW_DEPLOY_SALT=<bytes32>` when running `GitBondEscrowScript`
   (CREATE2 is now used by default).
-- The same deployer address, same salt, same implementation bytecode and same initializer args produce
-  deterministic addresses on each chain.
-- This script deploys both implementation and proxy with CREATE2 (`ERC1967Proxy`), making
-  proxy/implementation addresses predictable across chains.
+- The same deployer address, same salt, and same initializer args produce a deterministic proxy address
+  on each chain.
+- This script deploys the proxy with CREATE2 (`ERC1967Proxy`) for deterministic proxy addresses.
+  The implementation is deployed normally (non-CREATE2).
 
 Whitelist trust assumption:
 
diff --git a/foundry.toml b/foundry.toml
index ee999c3..b6fc929 100644
--- a/foundry.toml
+++ b/foundry.toml
@@ -9,4 +9,8 @@ build_info = true
 extra_output = ["storageLayout"]
 fs_permissions = [{ access = "read", path = "./out" }]
 
+# Silence solc warnings emitted from dependencies (e.g. OpenZeppelin foundry helpers under lib/).
+# Warnings from src/ and script/ are still shown.
+ignored_warnings_from = ["lib"]
+
 # See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options
diff --git a/script/GitBondEscrow.s.sol b/script/GitBondEscrow.s.sol
index 85af979..5209ac6 100644
--- a/script/GitBondEscrow.s.sol
+++ b/script/GitBondEscrow.s.sol
@@ -25,14 +25,12 @@ contract GitBondEscrowScript is Script {
 
         address escrowImplementation;
         address escrowProxy;
-        bytes32 implementationSalt = _saltForDeployment(deploymentSalt, "implementation");
         bytes32 proxySalt = _saltForDeployment(deploymentSalt, "proxy");
-        escrowImplementation = _deployImplementation(implementationFile, implementationSalt);
+        escrowImplementation = _deployImplementation(implementationFile);
         escrowProxy = _deployProxy(escrowImplementation, initData, proxySalt);
 
         console.log("CREATE2 mode: enabled");
         console.log("Salt:", vm.toString(deploymentSalt));
-        console.log("CREATE2 impl salt:", vm.toString(implementationSalt));
         console.log("CREATE2 proxy salt:", vm.toString(proxySalt));
 
         GitBondEscrow escrow = GitBondEscrow(escrowProxy);
@@ -41,8 +39,8 @@ contract GitBondEscrowScript is Script {
         require(escrow.treasury() == treasury && implementation != address(0), "Deployment post-conditions failed");
         require(escrowImplementation == implementation, "Implementation address mismatch");
 
-        console.log("GitBondEscrow implementation:", implementation);
-        console.log("CREATE2 implementation:", escrowImplementation);
+        console.log("Proxy-reported implementation:", implementation);
+        console.log("Locally deployed implementation:", escrowImplementation);
         console.log("GitBondEscrow proxy deployed:", escrowProxy);
         console.log("Escrow treasury:", escrow.treasury());
         console.log("Escrow owner:", escrow.owner());
@@ -52,11 +50,8 @@ contract GitBondEscrowScript is Script {
         vm.stopBroadcast();
     }
 
-    function _deployImplementation(string memory implementationFile, bytes32 implementationSalt)
-        internal
-        returns (address)
-    {
-        return vm.deployCode(implementationFile, bytes(""), implementationSalt);
+    function _deployImplementation(string memory implementationFile) internal returns (address) {
+        return vm.deployCode(implementationFile, bytes(""));
     }
 
     function _deployProxy(address escrowImplementation, bytes memory initData, bytes32 proxySalt)
diff --git a/src/GitBondEscrow.sol b/src/GitBondEscrow.sol
index c9c39d1..0a7ad5b 100644
--- a/src/GitBondEscrow.sol
+++ b/src/GitBondEscrow.sol
@@ -176,7 +176,7 @@ contract GitBondEscrow is
         _createEscrowFrom(payer, key, counterparty, beneficiary, token, amount, true, permit_);
     }
 
-    function refundEscrow(bytes32 key) external virtual whenNotPaused {
+    function refundEscrow(bytes32 key) external virtual whenNotPaused nonReentrant {
         GitBondEscrowStorage.Layout storage s = _layout();
         GitBondEscrowStorage.Escrow storage e = s.escrows[key];
 
@@ -194,7 +194,7 @@ contract GitBondEscrow is
         emit EscrowRefunded(key, e.payer, e.beneficiary, e.token, amountToReturn);
     }
 
-    function slashEscrow(bytes32 key) external virtual whenNotPaused {
+    function slashEscrow(bytes32 key) external virtual whenNotPaused nonReentrant {
         GitBondEscrowStorage.Layout storage s = _layout();
         GitBondEscrowStorage.Escrow storage e = s.escrows[key];
 
@@ -218,7 +218,7 @@ contract GitBondEscrow is
         emit EscrowSlashed(key, e.beneficiary, e.counterparty, e.token, amountToCounterparty, platformCut);
     }
 
-    function claim(address token) external virtual whenNotPaused {
+    function claim(address token) external virtual whenNotPaused nonReentrant {
         GitBondEscrowStorage.Layout storage s = _layout();
         uint256 amount = s.claimAmounts[msg.sender][token];