diff --git a/.mokogitea/workflows/issue-branch.yml b/.mokogitea/workflows/issue-branch.yml
index b5ef0e4..18c05b0 100644
--- a/.mokogitea/workflows/issue-branch.yml
+++ b/.mokogitea/workflows/issue-branch.yml
@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: moko-platform.Automation
-# VERSION: 09.15.00
+# VERSION: 09.17.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8b204d..ee6a034 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,12 +12,12 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]
 
+## [09.17.00] --- 2026-05-30
+
+## [09.16.00] --- 2026-05-30
+
 ## [09.15.00] --- 2026-05-30
 
 ## [09.14.00] --- 2026-05-30
 
 ## [09.13.00] --- 2026-05-30
-
-## [09.12.00] --- 2026-05-30
-
-## [09.11.00] --- 2026-05-30
diff --git a/README.md b/README.md
index 37d47d6..a6411b3 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ DEFGROUP: MokoStandards.Root
 INGROUP: MokoStandards
 REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 PATH: /README.md
-VERSION: 09.15.00
+VERSION: 09.17.00
 BRIEF: Project overview and documentation
 -->
 
diff --git a/cli/branch_rename.php b/cli/branch_rename.php
index 5ceb7f1..0d82488 100644
--- a/cli/branch_rename.php
+++ b/cli/branch_rename.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/branch_rename.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
  *
  * Usage:
diff --git a/cli/bulk_workflow_push.php b/cli/bulk_workflow_push.php
index 3a182a6..71b143f 100644
--- a/cli/bulk_workflow_push.php
+++ b/cli/bulk_workflow_push.php
@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
  */
 
diff --git a/cli/bulk_workflow_trigger.php b/cli/bulk_workflow_trigger.php
index 0e0ec17..a1d73f7 100644
--- a/cli/bulk_workflow_trigger.php
+++ b/cli/bulk_workflow_trigger.php
@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Trigger a workflow across multiple repos at once
  */
 
diff --git a/cli/client_dashboard.php b/cli/client_dashboard.php
index fea1876..07bce84 100644
--- a/cli/client_dashboard.php
+++ b/cli/client_dashboard.php
@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_dashboard.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Generate unified client dashboard HTML
  */
 
diff --git a/cli/client_inventory.php b/cli/client_inventory.php
index 52b1cf9..6def724 100644
--- a/cli/client_inventory.php
+++ b/cli/client_inventory.php
@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_inventory.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Discover and list all client-waas repos with their server configuration status
  */
 
diff --git a/cli/client_provision.php b/cli/client_provision.php
index 4af7ff2..4078648 100644
--- a/cli/client_provision.php
+++ b/cli/client_provision.php
@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_provision.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Provision a new client environment end-to-end
  */
 
diff --git a/cli/grafana_dashboard.php b/cli/grafana_dashboard.php
index 6cc792d..82ea953 100644
--- a/cli/grafana_dashboard.php
+++ b/cli/grafana_dashboard.php
@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Manage Grafana dashboards via API
  */
 
diff --git a/cli/joomla_build.php b/cli/joomla_build.php
index 47242da..f1b87a1 100644
--- a/cli/joomla_build.php
+++ b/cli/joomla_build.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/joomla_build.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
  * NOTE: Called by pre-release and auto-release workflows.
  *
diff --git a/cli/manifest_read.php b/cli/manifest_read.php
index ef61c2b..aa72e78 100644
--- a/cli/manifest_read.php
+++ b/cli/manifest_read.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/manifest_read.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Parse .manifest.xml and output requested field(s) for CI consumption
  *
  * Usage:
diff --git a/cli/release_cascade.php b/cli/release_cascade.php
index 5c0437c..d44e7c7 100644
--- a/cli/release_cascade.php
+++ b/cli/release_cascade.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_cascade.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: DEPRECATED — cascade behavior removed. Each release stream is independent.
  */
 
diff --git a/cli/release_publish.php b/cli/release_publish.php
index 37d5e81..625ee77 100644
--- a/cli/release_publish.php
+++ b/cli/release_publish.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_publish.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Publish a release and create copies for all lesser stability streams.
  *
  * When a release is published at a given stability, copies are created for all
diff --git a/cli/scaffold_client.php b/cli/scaffold_client.php
index aa768f6..b78e1fe 100644
--- a/cli/scaffold_client.php
+++ b/cli/scaffold_client.php
@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/scaffold_client.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
  */
 
diff --git a/cli/sync_rulesets.php b/cli/sync_rulesets.php
index 8b2361e..845f492 100644
--- a/cli/sync_rulesets.php
+++ b/cli/sync_rulesets.php
@@ -56,34 +56,38 @@ $PROTECTIONS = [
 		'name'   => 'MAIN — protect default branch',
 		'branch' => 'main',
 		'rules'  => [
-			'required_reviews'  => 1,
-			'dismiss_stale'     => true,
-			'enforce_admins'    => true,
-			'block_on_rejected' => true,
+			'required_reviews'       => 1,
+			'dismiss_stale'          => true,
+			'enforce_admins'         => true,
+			'block_on_rejected'      => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'VERSION — immutable snapshots',
 		'branch' => 'version/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'DEV — prevent branch deletion',
 		'branch' => 'dev/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'RC — prevent branch deletion',
 		'branch' => 'rc/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 ];
diff --git a/cli/updates_xml_sync.php b/cli/updates_xml_sync.php
index cebeab9..a7b8c12 100644
--- a/cli/updates_xml_sync.php
+++ b/cli/updates_xml_sync.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync updates.xml to target branches via Gitea API
  * NOTE: Called by pre-release and auto-release workflows after updates.xml
  *       is modified on the current branch. Pushes the file to other branches
diff --git a/cli/version_auto_bump.php b/cli/version_auto_bump.php
index e776ef3..326b57c 100644
--- a/cli/version_auto_bump.php
+++ b/cli/version_auto_bump.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_auto_bump.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
  *
  * Usage:
diff --git a/cli/version_check.php b/cli/version_check.php
index 2b12020..4d4030f 100644
--- a/cli/version_check.php
+++ b/cli/version_check.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_check.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Validate version consistency across README, manifests, and sub-packages
  *
  * Usage:
diff --git a/cli/wiki_sync.php b/cli/wiki_sync.php
index e7789f7..f1b3ee6 100644
--- a/cli/wiki_sync.php
+++ b/cli/wiki_sync.php
@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/wiki_sync.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync select wiki pages from moko-platform to all template repos
  */
 
diff --git a/deploy/backup-before-deploy.php b/deploy/backup-before-deploy.php
index 96bba6d..c448b12 100644
--- a/deploy/backup-before-deploy.php
+++ b/deploy/backup-before-deploy.php
@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Snapshot Joomla directories before deployment for rollback capability
  */
 
diff --git a/deploy/deploy-dolibarr.php b/deploy/deploy-dolibarr.php
index 461236e..1855896 100644
--- a/deploy/deploy-dolibarr.php
+++ b/deploy/deploy-dolibarr.php
@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
  */
 
diff --git a/deploy/health-check.php b/deploy/health-check.php
index 5101156..c01a556 100644
--- a/deploy/health-check.php
+++ b/deploy/health-check.php
@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/health-check.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
  */
 
diff --git a/deploy/rollback-joomla.php b/deploy/rollback-joomla.php
index d9c43cc..407774c 100644
--- a/deploy/rollback-joomla.php
+++ b/deploy/rollback-joomla.php
@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
  */
 
diff --git a/deploy/sync-joomla.php b/deploy/sync-joomla.php
index 276874e..1dc25c4 100644
--- a/deploy/sync-joomla.php
+++ b/deploy/sync-joomla.php
@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/sync-joomla.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
  */
 
diff --git a/lib/Enterprise/MokoGiteaAdapter.php b/lib/Enterprise/MokoGiteaAdapter.php
index 79b0c5c..5d973e7 100644
--- a/lib/Enterprise/MokoGiteaAdapter.php
+++ b/lib/Enterprise/MokoGiteaAdapter.php
@@ -373,17 +373,20 @@ class MokoGiteaAdapter implements GitPlatformAdapter
     public function setBranchProtection(string $org, string $repo, string $branch, array $rules): array
     {
         // Gitea uses a flat branch protection API
+        $whitelistActions = $rules['whitelist_actions_user'] ?? false;
         $protection = [
-            'branch_name'                     => $branch,
-            'enable_push'                     => true,
-            'enable_push_whitelist'            => false,
-            'enable_merge_whitelist'           => false,
-            'enable_status_check'             => $rules['required_status_checks'] ?? false,
-            'enable_approvals_whitelist'       => false,
-            'required_approvals'              => $rules['required_reviews'] ?? 0,
-            'dismiss_stale_approvals'         => $rules['dismiss_stale'] ?? false,
-            'block_on_rejected_reviews'       => $rules['block_on_rejected'] ?? true,
-            'block_on_outdated_branch'        => $rules['block_on_outdated'] ?? false,
+            'branch_name'                       => $branch,
+            'enable_push'                       => true,
+            'enable_push_whitelist'              => $whitelistActions,
+            'push_whitelist_actions_user'        => $whitelistActions,
+            'enable_merge_whitelist'             => false,
+            'merge_whitelist_actions_user'       => $whitelistActions,
+            'enable_status_check'               => $rules['required_status_checks'] ?? false,
+            'enable_approvals_whitelist'         => false,
+            'required_approvals'                => $rules['required_reviews'] ?? 0,
+            'dismiss_stale_approvals'           => $rules['dismiss_stale'] ?? false,
+            'block_on_rejected_reviews'         => $rules['block_on_rejected'] ?? true,
+            'block_on_outdated_branch'          => $rules['block_on_outdated'] ?? false,
             'block_on_official_review_requests' => false,
         ];
 
diff --git a/tests/Unit/VersionBumpTest.php b/tests/Unit/VersionBumpTest.php
index 6f36660..ebd2e6e 100644
--- a/tests/Unit/VersionBumpTest.php
+++ b/tests/Unit/VersionBumpTest.php
@@ -63,7 +63,7 @@ class VersionBumpTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.15.00 -->\nSome content\n"
+            "<!-- VERSION: 09.17.00 -->\nSome content\n"
         );
 
         $this->execute();
diff --git a/tests/Unit/VersionReadTest.php b/tests/Unit/VersionReadTest.php
index f0b8a42..ff99465 100644
--- a/tests/Unit/VersionReadTest.php
+++ b/tests/Unit/VersionReadTest.php
@@ -34,7 +34,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "# Test\n<!-- VERSION: 09.15.00 -->\n"
+            "# Test\n<!-- VERSION: 09.17.00 -->\n"
         );
 
         $this->assertSame('02.03.04', trim($this->runScript()));
@@ -68,7 +68,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.15.00 -->\n"
+            "<!-- VERSION: 09.17.00 -->\n"
         );
         mkdir("{$this->tmpDir}/src", 0755, true);
         file_put_contents(
diff --git a/validate/check_file_integrity.php b/validate/check_file_integrity.php
index 5393842..806c4ac 100644
--- a/validate/check_file_integrity.php
+++ b/validate/check_file_integrity.php
@@ -12,7 +12,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /validate/check_file_integrity.php
- * VERSION: 09.15.00
+ * VERSION: 09.17.00
  * BRIEF: Compare deployed files on a remote server against the local repository to detect drift
  */