From 31424c58fa9deb5a4cfc49fd48778ae13cfd0a81 Mon Sep 17 00:00:00 2001
From: Nathan Broadbent <git@ndbroadbent.com>
Date: Fri, 9 Oct 2026 17:00:56 +1300
Subject: [PATCH 1/3] Bind deploy approvals to the approved commit and artifact

An approval used to authorize "a build" for the token and app, so a
compromised CI job could ship any tarball or image under it: git-sha was
optional (DocSpring CI never sends one), the build's archive wasn't
compared with the upload, and image patterns were optional and unanchored.

Token builds under an approval now:
- must use the archive uploaded under that same approval, chosen
  deterministically (no "most recent approved" lookup);
- take the commit from the approval record, never from the client. A
  git-sha, if sent, must equal it, and approvals need a full 40-hex SHA;
- may only reference pre-built images tagged <sha> or <sha>-<suffix>.
  Services built from source are rejected;
- require service_image_patterns, so the image repository is pinned
  too. Patterns are anchored and the substituted commit is regex-escaped.

Also:
- approved_deploy_commands fails closed: an empty list allows no
  commands under an approval. The CLI E2E seed stored it as
  {"commands": [...]}, which was silently read as empty and so allowed
  anything; it now uses the plain array production uses.
- GitHub verification: "branch" mode requires the commit to be on the
  feature branch (compare status behind/identical, not any 200),
  "latest" mode compares full SHAs, and URL segments are path-escaped.
- CircleCI auto-approve checks the workflow's pipeline revision and
  repository against the approval (and rejects fork pipelines) before
  approving the hold job. workflow_id must be a UUID.
- CircleCI and GitHub API tokens are no longer stored in River job
  args; workers read them from config. The Jobs API redacts token-,
  secret-, password- and key-like arg keys.
---
 .../integrations/deploy-approvals/index.mdx   |  15 +-
 internal/gateway/app/setup.go                 |   2 +
 internal/gateway/circleci/client.go           |  19 +-
 .../gateway/circleci/pipeline_verification.go | 117 +++++++
 .../circleci/pipeline_verification_test.go    | 109 ++++++
 internal/gateway/db/commit_sha.go             |  22 ++
 internal/gateway/db/database_test.go          |  43 ++-
 .../db/deploy_approval_requests_mutations.go  |   6 +-
 .../db/deploy_approval_requests_queries.go    |  18 +-
 internal/gateway/github/client.go             | 128 +++++---
 internal/gateway/github/verify_commit_test.go |  94 ++++++
 internal/gateway/handlers/admin_jobs.go       |  11 +-
 .../gateway/handlers/deploy_approval_admin.go |  18 +-
 .../handlers/deploy_approval_notification.go  |   9 +-
 .../deploy_approval_requests_mfa_test.go      |   4 +-
 .../handlers/deploy_approval_requests_test.go |  62 ++--
 .../handlers/deploy_approval_validation.go    |   7 +-
 .../gateway/handlers/job_args_redaction.go    |  60 ++++
 .../handlers/job_args_redaction_test.go       |  42 +++
 internal/gateway/jobs/circleci/approve.go     |  34 +-
 .../gateway/jobs/circleci/approve_test.go     |  23 +-
 internal/gateway/jobs/client.go               |   8 +-
 internal/gateway/jobs/github/pr_comment.go    |  21 +-
 .../gateway/jobs/github/pr_comment_test.go    |  11 +-
 internal/gateway/proxy/approval_resolvers.go  | 309 ++++++++++++++++++
 .../proxy/deploy_approval_binding_test.go     | 242 ++++++++++++++
 .../proxy/deploy_approval_tracking_test.go    |  68 ++--
 .../proxy/deploy_approval_validation.go       | 186 ++++-------
 internal/gateway/proxy/env_filters.go         |   6 +-
 internal/gateway/proxy/forward.go             |  29 +-
 internal/gateway/proxy/manifest_policy.go     | 152 +++++++++
 internal/gateway/proxy/manifest_validation.go |  74 +----
 internal/gateway/proxy/token_permissions.go   | 271 ---------------
 scripts/lib/cli-e2e/db.sh                     |   2 +-
 web/e2e/db.ts                                 |   2 +-
 35 files changed, 1556 insertions(+), 668 deletions(-)
 create mode 100644 internal/gateway/circleci/pipeline_verification.go
 create mode 100644 internal/gateway/circleci/pipeline_verification_test.go
 create mode 100644 internal/gateway/db/commit_sha.go
 create mode 100644 internal/gateway/github/verify_commit_test.go
 create mode 100644 internal/gateway/handlers/job_args_redaction.go
 create mode 100644 internal/gateway/handlers/job_args_redaction_test.go
 create mode 100644 internal/gateway/proxy/approval_resolvers.go
 create mode 100644 internal/gateway/proxy/deploy_approval_binding_test.go
 create mode 100644 internal/gateway/proxy/manifest_policy.go

diff --git a/docs/src/content/docs/integrations/deploy-approvals/index.mdx b/docs/src/content/docs/integrations/deploy-approvals/index.mdx
index 94220c8d..b5f8ac0d 100644
--- a/docs/src/content/docs/integrations/deploy-approvals/index.mdx
+++ b/docs/src/content/docs/integrations/deploy-approvals/index.mdx
@@ -94,11 +94,14 @@ graph TB
 
 ### Git Commit Verification
 
-Every approval is tied to a specific git commit hash:
+Every approval is tied to a specific full (40-character) git commit SHA. An API token deploying under an approval must:
 
-- Approval cannot be reused for different code
-- Manifest validation ensures deployed images match approved commit
-- Prevents deploying arbitrary code even with compromised CI/CD token
+- Build the archive it uploaded under that approval (one upload and one build per approval)
+- Send no `git-sha`, or one equal to the approved commit (the gateway always uses the approved commit, never the client's)
+- Reference only pre-built images, each tagged with the approved commit (`<sha>` or `<sha>-<suffix>`, e.g. `<sha>-amd64`) and matching the app's `service_image_patterns`
+- Run only commands listed in `approved_deploy_commands` (an empty list allows none)
+
+`service_image_patterns` is required for approval-bound builds: the commit tag alone does not pin the image repository.
 
 ### MFA Step-Up
 
@@ -183,7 +186,9 @@ Configure via UI or environment variables:
 | `vcs_repo` | Repository in org/repo format |
 | `ci_provider` | CI system (circleci) |
 | `circleci_approval_job_name` | CircleCI approval job name |
-| `circleci_auto_approve_on_approval` | Enable auto-approval |
+| `circleci_auto_approve_on_approval` | Enable auto-approval (the gateway first checks the workflow's pipeline builds the approved commit of `vcs_repo`) |
+| `service_image_patterns` | **Required.** Map of service name (or `*`) to an anchored regex; `{{GIT_COMMIT}}` is replaced with the approved commit, e.g. `{"*": "docker\\.io/org/app:{{GIT_COMMIT}}-amd64"}` |
+| `approved_deploy_commands` | Exact commands a token may run under an approval (e.g. migrations); empty allows none |
 
 <Aside type="tip">
 Configure per-app settings via environment variables:
diff --git a/internal/gateway/app/setup.go b/internal/gateway/app/setup.go
index e52bfc3b..c098dc93 100644
--- a/internal/gateway/app/setup.go
+++ b/internal/gateway/app/setup.go
@@ -290,6 +290,8 @@ func (a *App) initJobsClient(sender email.Sender, notifier *slackpkg.Notifier) e
 		Database:      a.Database,
 		EmailSender:   sender,
 		SlackNotifier: notifier,
+		CircleCIToken: a.Config.CircleCIToken,
+		GitHubToken:   a.Config.GitHubToken,
 	}, auditAnchorConfig)
 	if err != nil {
 		return fmt.Errorf("failed to initialize jobs client: %w", err)
diff --git a/internal/gateway/circleci/client.go b/internal/gateway/circleci/client.go
index d6c32edc..950ae36f 100644
--- a/internal/gateway/circleci/client.go
+++ b/internal/gateway/circleci/client.go
@@ -63,10 +63,12 @@ type ApprovalMetadata struct {
 }
 
 // ApproveJob approves a pending approval job in a CircleCI workflow.
+// The workflow's pipeline must be building the approved revision of the expected repository;
+// otherwise ErrPipelineMismatch is returned and nothing is approved.
 // It handles workflow reruns by finding the latest workflow with the same name in the pipeline.
-func (c *Client) ApproveJob(workflowID, pipelineNumber, jobName string) error {
-	if workflowID == "" {
-		return fmt.Errorf("workflow_id is required")
+func (c *Client) ApproveJob(workflowID, pipelineNumber, jobName string, expect ApprovalExpectation) error {
+	if err := ValidateWorkflowID(workflowID); err != nil {
+		return err
 	}
 	if pipelineNumber == "" {
 		return fmt.Errorf("pipeline_number is required")
@@ -81,6 +83,14 @@ func (c *Client) ApproveJob(workflowID, pipelineNumber, jobName string) error {
 		return fmt.Errorf("failed to get workflow details: %w", err)
 	}
 
+	pipeline, err := c.getPipeline(originalWorkflow.PipelineID)
+	if err != nil {
+		return fmt.Errorf("failed to get pipeline: %w", err)
+	}
+	if err := verifyPipeline(pipeline, expect); err != nil {
+		return err
+	}
+
 	// Find the latest workflow with the same name in the pipeline
 	// Use the pipeline ID (UUID) from the workflow, not the pipeline number
 	latestWorkflowID, err := c.findLatestWorkflowByName(originalWorkflow.PipelineID, originalWorkflow.Name)
@@ -248,6 +258,9 @@ func ValidateMetadata(metadata map[string]interface{}) error {
 	if !ok || strings.TrimSpace(workflowID) == "" {
 		return fmt.Errorf("ci_metadata.workflow_id is required")
 	}
+	if err := ValidateWorkflowID(workflowID); err != nil {
+		return fmt.Errorf("ci_metadata.workflow_id: %w", err)
+	}
 
 	pipelineNumber, ok := metadata["pipeline_number"].(string)
 	if !ok || strings.TrimSpace(pipelineNumber) == "" {
diff --git a/internal/gateway/circleci/pipeline_verification.go b/internal/gateway/circleci/pipeline_verification.go
new file mode 100644
index 00000000..ddc1c601
--- /dev/null
+++ b/internal/gateway/circleci/pipeline_verification.go
@@ -0,0 +1,117 @@
+package circleci
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+var (
+	// ErrPipelineMismatch means the workflow's pipeline is not building the approved commit/repository.
+	ErrPipelineMismatch = errors.New("CircleCI pipeline does not match the deploy approval")
+	// ErrInvalidWorkflowID means the workflow ID is not a CircleCI UUID.
+	ErrInvalidWorkflowID = errors.New("invalid CircleCI workflow_id")
+
+	uuidPattern = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
+)
+
+// ApprovalExpectation is what the pipeline behind a workflow must match before its hold job is approved.
+type ApprovalExpectation struct {
+	// Revision is the full commit SHA the deploy approval was granted for (required).
+	Revision string
+	// Repo is the app's "owner/repo" VCS repository. When empty, only the revision is checked.
+	Repo string
+}
+
+// ValidateWorkflowID reports an error unless workflowID is a CircleCI workflow UUID.
+func ValidateWorkflowID(workflowID string) error {
+	if !uuidPattern.MatchString(workflowID) {
+		return fmt.Errorf("%w: %q", ErrInvalidWorkflowID, workflowID)
+	}
+	return nil
+}
+
+type pipelineDetails struct {
+	ID          string `json:"id"`
+	ProjectSlug string `json:"project_slug"`
+	VCS         struct {
+		Revision            string `json:"revision"`
+		TargetRepositoryURL string `json:"target_repository_url"`
+		OriginRepositoryURL string `json:"origin_repository_url"`
+	} `json:"vcs"`
+}
+
+func (c *Client) getPipeline(pipelineID string) (*pipelineDetails, error) {
+	body, err := c.doRequest(http.MethodGet, fmt.Sprintf("%s/pipeline/%s", c.BaseURL, url.PathEscape(pipelineID)))
+	if err != nil {
+		return nil, err
+	}
+	var details pipelineDetails
+	if err := json.Unmarshal(body, &details); err != nil {
+		return nil, fmt.Errorf("failed to parse pipeline: %w", err)
+	}
+	return &details, nil
+}
+
+// verifyPipeline checks that a pipeline builds the expected revision of the expected repository,
+// and is not a pipeline for a fork's code.
+func verifyPipeline(pipeline *pipelineDetails, expect ApprovalExpectation) error {
+	revision := strings.TrimSpace(expect.Revision)
+	if revision == "" {
+		return fmt.Errorf("%w: no approved revision", ErrPipelineMismatch)
+	}
+	if !strings.EqualFold(strings.TrimSpace(pipeline.VCS.Revision), revision) {
+		return fmt.Errorf("%w: pipeline revision %q, approved %q", ErrPipelineMismatch, pipeline.VCS.Revision, revision)
+	}
+
+	target := repoFromURL(pipeline.VCS.TargetRepositoryURL)
+	origin := repoFromURL(pipeline.VCS.OriginRepositoryURL)
+	if origin != "" && target != "" && !strings.EqualFold(origin, target) {
+		return fmt.Errorf("%w: pipeline builds code from fork %s", ErrPipelineMismatch, origin)
+	}
+
+	expectedRepo := strings.TrimSpace(expect.Repo)
+	if expectedRepo == "" {
+		return nil
+	}
+	actual := target
+	if actual == "" {
+		actual = repoFromProjectSlug(pipeline.ProjectSlug)
+	}
+	if actual != "" && !strings.EqualFold(actual, expectedRepo) {
+		return fmt.Errorf("%w: pipeline repository %s, expected %s", ErrPipelineMismatch, actual, expectedRepo)
+	}
+	return nil
+}
+
+// repoFromURL returns "owner/repo" for a repository URL like https://github.com/owner/repo(.git).
+func repoFromURL(raw string) string {
+	parsed, err := url.Parse(strings.TrimSpace(raw))
+	if err != nil || parsed.Host == "" {
+		return ""
+	}
+	parts := strings.Split(strings.Trim(strings.TrimSuffix(parsed.Path, ".git"), "/"), "/")
+	if len(parts) != 2 {
+		return ""
+	}
+	return parts[0] + "/" + parts[1]
+}
+
+// repoFromProjectSlug returns "owner/repo" for VCS-style project slugs ("gh/owner/repo").
+// GitHub App projects ("circleci/<org-id>/<project-id>") don't name the repository.
+func repoFromProjectSlug(slug string) string {
+	parts := strings.Split(strings.TrimSpace(slug), "/")
+	if len(parts) != 3 {
+		return ""
+	}
+	switch parts[0] {
+	case "gh", "github", "bb", "bitbucket":
+		return parts[1] + "/" + parts[2]
+	default:
+		return ""
+	}
+}
diff --git a/internal/gateway/circleci/pipeline_verification_test.go b/internal/gateway/circleci/pipeline_verification_test.go
new file mode 100644
index 00000000..64f0ba61
--- /dev/null
+++ b/internal/gateway/circleci/pipeline_verification_test.go
@@ -0,0 +1,109 @@
+package circleci
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testWorkflowID = "11111111-2222-3333-4444-555555555555"
+	testPipelineID = "99999999-8888-7777-6666-555555555555"
+	approvedSHA    = "0123456789abcdef0123456789abcdef01234567"
+	docspringRepo  = "https://github.com/DocSpring/docspring"
+)
+
+type fakePipeline struct {
+	revision, targetRepo, originRepo, slug string
+}
+
+// newFakeCircleCI serves the workflow/pipeline/job endpoints ApproveJob uses and counts approvals.
+func newFakeCircleCI(t *testing.T, pipeline fakePipeline) (*Client, *int32) {
+	t.Helper()
+	var approvals int32
+	write := func(w http.ResponseWriter, v interface{}) { _ = json.NewEncoder(w).Encode(v) }
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && strings.Contains(r.URL.Path, "/approve/"):
+			atomic.AddInt32(&approvals, 1)
+			write(w, map[string]string{"message": "Accepted."})
+		case r.URL.Path == "/workflow/"+testWorkflowID:
+			write(w, map[string]string{"id": testWorkflowID, "name": "deploy", "pipeline_id": testPipelineID})
+		case r.URL.Path == "/pipeline/"+testPipelineID:
+			vcs := map[string]string{
+				"revision":              pipeline.revision,
+				"target_repository_url": pipeline.targetRepo,
+				"origin_repository_url": pipeline.originRepo,
+			}
+			write(w, map[string]interface{}{"id": testPipelineID, "project_slug": pipeline.slug, "vcs": vcs})
+		case r.URL.Path == "/pipeline/"+testPipelineID+"/workflow":
+			write(w, map[string]interface{}{"items": []map[string]string{{"id": testWorkflowID, "name": "deploy"}}})
+		case r.URL.Path == "/workflow/"+testWorkflowID+"/job":
+			write(w, map[string]interface{}{"items": []map[string]string{
+				{"id": "job-1", "name": "approve_deploy_us", "type": "approval"},
+			}})
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(server.Close)
+	client := NewClient("token")
+	client.BaseURL = server.URL
+	return client, &approvals
+}
+
+func TestApproveJobApprovesMatchingPipeline(t *testing.T) {
+	client, approvals := newFakeCircleCI(t, fakePipeline{
+		revision: approvedSHA, targetRepo: docspringRepo, originRepo: docspringRepo, slug: "gh/DocSpring/docspring",
+	})
+	err := client.ApproveJob(testWorkflowID, "100", "approve_deploy_us",
+		ApprovalExpectation{Revision: approvedSHA, Repo: "DocSpring/docspring"})
+	require.NoError(t, err)
+	require.EqualValues(t, 1, *approvals)
+}
+
+func TestApproveJobRefusesMismatchedPipelines(t *testing.T) {
+	cases := map[string]fakePipeline{
+		"different commit": {
+			revision: strings.Repeat("f", 40), targetRepo: docspringRepo, originRepo: docspringRepo,
+		},
+		"different repository": {
+			revision: approvedSHA, targetRepo: "https://github.com/attacker/docspring",
+			originRepo: "https://github.com/attacker/docspring",
+		},
+		"fork pipeline": {
+			revision: approvedSHA, targetRepo: docspringRepo, originRepo: "https://github.com/attacker/docspring",
+		},
+		"different project slug": {revision: approvedSHA, slug: "gh/attacker/other"},
+	}
+	for name, pipeline := range cases {
+		t.Run(name, func(t *testing.T) {
+			client, approvals := newFakeCircleCI(t, pipeline)
+			err := client.ApproveJob(testWorkflowID, "100", "approve_deploy_us",
+				ApprovalExpectation{Revision: approvedSHA, Repo: "DocSpring/docspring"})
+			require.ErrorIs(t, err, ErrPipelineMismatch)
+			require.EqualValues(t, 0, *approvals, "nothing may be approved on a mismatch")
+		})
+	}
+}
+
+func TestApproveJobRejectsNonUUIDWorkflowID(t *testing.T) {
+	client, approvals := newFakeCircleCI(t, fakePipeline{revision: approvedSHA})
+	for _, id := range []string{"test-workflow-1", "../pipeline/x", ""} {
+		err := client.ApproveJob(id, "100", "approve_deploy_us", ApprovalExpectation{Revision: approvedSHA})
+		require.ErrorIs(t, err, ErrInvalidWorkflowID)
+	}
+	require.EqualValues(t, 0, *approvals)
+}
+
+func TestParseMetadataRequiresUUIDWorkflowID(t *testing.T) {
+	_, err := ParseMetadata(map[string]interface{}{
+		"workflow_id": "not-a-uuid", "pipeline_number": "1", "approval_job_name": "hold",
+	})
+	require.ErrorIs(t, err, ErrInvalidWorkflowID)
+}
diff --git a/internal/gateway/db/commit_sha.go b/internal/gateway/db/commit_sha.go
new file mode 100644
index 00000000..db4bae8c
--- /dev/null
+++ b/internal/gateway/db/commit_sha.go
@@ -0,0 +1,22 @@
+package db
+
+import (
+	"regexp"
+	"strings"
+)
+
+var fullCommitSHAPattern = regexp.MustCompile(`^[0-9a-f]{40}$`)
+
+// NormalizeCommitSHA trims and lowercases a git commit hash and reports whether it is a
+// full 40-character SHA-1. Deploy approvals are bound to full commits only.
+func NormalizeCommitSHA(value string) (string, bool) {
+	normalized := strings.ToLower(strings.TrimSpace(value))
+	return normalized, fullCommitSHAPattern.MatchString(normalized)
+}
+
+// likePrefixPattern escapes LIKE wildcards in prefix and appends % so it only matches values
+// that start with the literal prefix. Use with "LIKE ? ESCAPE '\'".
+func likePrefixPattern(prefix string) string {
+	escaped := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`).Replace(prefix)
+	return escaped + "%"
+}
diff --git a/internal/gateway/db/database_test.go b/internal/gateway/db/database_test.go
index 9c46bbed..41c000fa 100644
--- a/internal/gateway/db/database_test.go
+++ b/internal/gateway/db/database_test.go
@@ -1,6 +1,7 @@
 package db_test
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -585,17 +586,25 @@ func TestDeployApprovalShortCommitHashMatching(t *testing.T) {
 	require.NoError(t, err)
 	require.Len(t, results, 1, "should find request with full commit hash")
 
-	// Test 3: FindDeployApprovalRequest with short commit hash
+	// Test 3: FindDeployApprovalRequest binds to the exact full commit, never a prefix
 	found, err := db.FindDeployApprovalRequest(gwdb.DeployApprovalLookup{
 		TokenID:       token.ID,
-		GitCommitHash: shortHash,
+		GitCommitHash: fullCommitHash,
 		App:           "myapp",
 		StatusFilter:  "pending",
 	})
 	require.NoError(t, err)
-	require.NotNil(t, found, "should find request with short commit hash via FindDeployApprovalRequest")
+	require.NotNil(t, found)
 	assert.Equal(t, fullCommitHash, found.GitCommitHash)
 
+	_, err = db.FindDeployApprovalRequest(gwdb.DeployApprovalLookup{
+		TokenID:       token.ID,
+		GitCommitHash: shortHash,
+		App:           "myapp",
+		StatusFilter:  "pending",
+	})
+	require.ErrorIs(t, err, gwdb.ErrDeployApprovalRequestNotFound, "short hashes must not match a lookup")
+
 	// Test 4: Non-matching short hash returns no results
 	results, err = db.ListDeployApprovalRequests(gwdb.DeployApprovalRequestListOptions{
 		GitCommitHash: "zzz999",
@@ -603,4 +612,32 @@ func TestDeployApprovalShortCommitHashMatching(t *testing.T) {
 	})
 	require.NoError(t, err)
 	assert.Len(t, results, 0, "should not find request with non-matching prefix")
+
+	// Test 5: LIKE wildcards in the prefix are literal
+	for _, wildcard := range []string{"%", "_", "abc%", "a_c"} {
+		results, err = db.ListDeployApprovalRequests(gwdb.DeployApprovalRequestListOptions{
+			GitCommitHash: wildcard,
+			App:           "myapp",
+		})
+		require.NoError(t, err)
+		assert.Len(t, results, 0, "wildcard %q must not match", wildcard)
+	}
+}
+
+func TestDeployApprovalRequiresFullCommitSHA(t *testing.T) {
+	db := dbtest.NewDatabase(t)
+	user, err := db.CreateUser("deployer@example.com", "Deployer", []string{"deployer"})
+	require.NoError(t, err)
+	token, err := db.CreateAPIToken(strings.Repeat("e", 64), "ci-token", user.ID, nil, nil, nil)
+	require.NoError(t, err)
+
+	for _, commit := range []string{"abc123", "a", strings.Repeat("g", 40), strings.Repeat("a", 41)} {
+		_, err = db.CreateDeployApprovalRequest("msg", "myapp", commit, "branch", "", nil, user.ID, nil, token.ID)
+		require.Error(t, err, "commit %q must be rejected", commit)
+	}
+
+	upper := strings.ToUpper("abc123def456789012345678901234567890abcd")
+	created, err := db.CreateDeployApprovalRequest("msg", "myapp", upper, "branch", "", nil, user.ID, nil, token.ID)
+	require.NoError(t, err)
+	assert.Equal(t, strings.ToLower(upper), created.GitCommitHash, "commits are stored lowercase")
 }
diff --git a/internal/gateway/db/deploy_approval_requests_mutations.go b/internal/gateway/db/deploy_approval_requests_mutations.go
index 5335e692..539fa289 100644
--- a/internal/gateway/db/deploy_approval_requests_mutations.go
+++ b/internal/gateway/db/deploy_approval_requests_mutations.go
@@ -51,9 +51,9 @@ func validateAndNormalizeDeployApprovalInput(
 	if app == "" {
 		return "", "", "", fmt.Errorf("app is required")
 	}
-	gitCommitHash = strings.TrimSpace(gitCommitHash)
-	if gitCommitHash == "" {
-		return "", "", "", fmt.Errorf("git_commit_hash is required")
+	gitCommitHash, ok := NormalizeCommitSHA(gitCommitHash)
+	if !ok {
+		return "", "", "", fmt.Errorf("git_commit_hash must be a full 40-character commit SHA")
 	}
 	if targetAPITokenID <= 0 {
 		return "", "", "", fmt.Errorf("target api token required")
diff --git a/internal/gateway/db/deploy_approval_requests_queries.go b/internal/gateway/db/deploy_approval_requests_queries.go
index 599c560f..8efb8ab9 100644
--- a/internal/gateway/db/deploy_approval_requests_queries.go
+++ b/internal/gateway/db/deploy_approval_requests_queries.go
@@ -20,8 +20,9 @@ func (d *Database) GetDeployApprovalRequestByPublicID(publicID string) (*DeployA
 // DeployApprovalLookup contains criteria for finding a deploy approval request
 type DeployApprovalLookup struct {
 	TokenID       int64
-	GitCommitHash string
+	GitCommitHash string // full commit SHA, matched exactly
 	App           string
+	ObjectURL     string
 	ReleaseID     string
 	BuildID       string
 	ProcessID     string
@@ -34,14 +35,17 @@ func (d *Database) FindDeployApprovalRequest(lookup DeployApprovalLookup) (*Depl
 	args := []interface{}{lookup.TokenID}
 
 	if lookup.GitCommitHash != "" {
-		// Support both short and full commit hashes via prefix match
-		clauses = append(clauses, "dr.git_commit_hash LIKE ?")
-		args = append(args, lookup.GitCommitHash+"%")
+		clauses = append(clauses, "dr.git_commit_hash = ?")
+		args = append(args, strings.ToLower(strings.TrimSpace(lookup.GitCommitHash)))
 	}
 	if lookup.App != "" {
 		clauses = append(clauses, "dr.app = ?")
 		args = append(args, lookup.App)
 	}
+	if lookup.ObjectURL != "" {
+		clauses = append(clauses, "dr.object_url = ?")
+		args = append(args, lookup.ObjectURL)
+	}
 	if lookup.ReleaseID != "" {
 		clauses = append(clauses, "dr.release_id = ?")
 		args = append(args, lookup.ReleaseID)
@@ -113,9 +117,9 @@ func (d *Database) ListDeployApprovalRequests(opts DeployApprovalRequestListOpti
 		args = append(args, opts.GitBranch)
 	}
 	if opts.GitCommitHash != "" {
-		// Support both short and full commit hashes via prefix match
-		clauses = append(clauses, "dr.git_commit_hash LIKE ?")
-		args = append(args, opts.GitCommitHash+"%")
+		// Listing accepts short hashes (e.g. `deploy-approval approve` on the current commit)
+		clauses = append(clauses, `dr.git_commit_hash LIKE ? ESCAPE '\'`)
+		args = append(args, likePrefixPattern(strings.ToLower(strings.TrimSpace(opts.GitCommitHash))))
 	}
 	if opts.App != "" {
 		clauses = append(clauses, "dr.app = ?")
diff --git a/internal/gateway/github/client.go b/internal/gateway/github/client.go
index 6829340f..db841350 100644
--- a/internal/gateway/github/client.go
+++ b/internal/gateway/github/client.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"
 	"time"
@@ -12,22 +13,36 @@ import (
 	"github.com/DocSpring/rack-gateway/internal/gateway/settings"
 )
 
+const defaultAPIBaseURL = "https://api.github.com"
+
 // Client handles GitHub API requests
 type Client struct {
 	token      string
+	apiBaseURL string
 	httpClient *http.Client
 }
 
 // NewClient creates a new GitHub API client
 func NewClient(token string) *Client {
 	return &Client{
-		token: token,
+		token:      token,
+		apiBaseURL: defaultAPIBaseURL,
 		httpClient: &http.Client{
 			Timeout: 30 * time.Second,
 		},
 	}
 }
 
+// repoURL builds an API URL under /repos/{owner}/{repo}, path-escaping every segment.
+func (c *Client) repoURL(owner, repo string, segments ...string) string {
+	parts := make([]string, 0, 4+len(segments))
+	parts = append(parts, c.apiBaseURL, "repos", url.PathEscape(owner), url.PathEscape(repo))
+	for _, segment := range segments {
+		parts = append(parts, url.PathEscape(segment))
+	}
+	return strings.Join(parts, "/")
+}
+
 // PullRequest represents a GitHub pull request
 type PullRequest struct {
 	Number  int    `json:"number"`
@@ -91,7 +106,7 @@ type VerifyCommitOptions struct {
 // doRequest executes an HTTP request to the GitHub API with standard headers and error handling.
 // Parameters:
 //   - method: HTTP method (GET, POST, etc.)
-//   - url: Full API URL
+//   - apiURL: Full API URL
 //   - body: Optional request body (can be nil)
 //   - expectedStatus: Expected HTTP status code(s) for success
 //   - notFoundError: Optional custom error message for 404 responses (if empty, 404 is treated as a regular error)
@@ -99,13 +114,13 @@ type VerifyCommitOptions struct {
 //
 // Returns an error if the request fails, returns unexpected status, or JSON decoding fails.
 func (c *Client) doRequest(
-	method, url string,
+	method, apiURL string,
 	body io.Reader,
 	expectedStatus int,
 	notFoundError string,
 	target interface{},
 ) error {
-	req, err := http.NewRequest(method, url, body)
+	req, err := http.NewRequest(method, apiURL, body)
 	if err != nil {
 		return fmt.Errorf("failed to create request: %w", err)
 	}
@@ -145,10 +160,11 @@ func (c *Client) doRequest(
 
 // VerifyCommitAndFindPR verifies a commit against GitHub and optionally finds a PR.
 // The behavior depends on the options:
-// - Mode "latest": commit must be the latest on the specified branch
-// - Mode "branch": commit must exist on the specified branch (uses git compare API)
+// - Mode "latest": commit must be the current head of the specified branch
+// - Mode "branch": commit must be on the specified branch (the head or one of its ancestors)
 // - RequirePR: if true, requires an open PR for the branch
-// Returns the PR URL if found (empty string if not required/found), or an error.
+// commitHash must be a full 40-character SHA. Returns the PR URL if found (empty string if not
+// required/found), or an error.
 func (c *Client) VerifyCommitAndFindPR(
 	owner, repo, branch, commitHash string,
 	opts VerifyCommitOptions,
@@ -157,81 +173,90 @@ func (c *Client) VerifyCommitAndFindPR(
 		return "", fmt.Errorf("GitHub token not configured")
 	}
 
-	// 1. Get the branch info
 	branchInfo, err := c.getBranch(owner, repo, branch)
 	if err != nil {
 		return "", fmt.Errorf("failed to get branch info: %w", err)
 	}
 
-	// 2. Verify commit based on mode
-	switch opts.Mode {
-	case settings.VerifyGitCommitModeLatest:
-		// Check if the commit hash matches the latest commit on the branch
-		if !strings.HasPrefix(branchInfo.Commit.SHA, commitHash) &&
-			!strings.HasPrefix(commitHash, branchInfo.Commit.SHA) {
-			return "", fmt.Errorf(
-				"commit %s is not the latest commit on branch %s (latest: %s)",
-				commitHash,
-				branch,
-				branchInfo.Commit.SHA,
-			)
-		}
-	case settings.VerifyGitCommitModeBranch:
-		// Verify commit exists on the branch using compare API
-		if err := c.verifyCommitOnBranch(owner, repo, branch, commitHash, branchInfo.Commit.SHA); err != nil {
-			return "", err
-		}
-	default:
-		return "", fmt.Errorf(
-			"invalid verify_git_commit_mode: %s (must be '%s' or '%s')",
-			opts.Mode,
-			settings.VerifyGitCommitModeBranch,
-			settings.VerifyGitCommitModeLatest,
-		)
+	if err := c.verifyCommitForMode(owner, repo, branch, commitHash, branchInfo.Commit.SHA, opts.Mode); err != nil {
+		return "", err
 	}
 
-	// 3. Always look up the PR (for informational purposes)
+	// Always look up the PR (for informational purposes)
 	pr, err := c.findPRForBranch(owner, repo, branch)
 	if err != nil {
 		// Don't fail on PR lookup errors if PR is not required
 		if opts.RequirePR {
 			return "", fmt.Errorf("failed to find PR for branch: %w", err)
 		}
-		// Just log and continue if PR lookup fails but isn't required
 		return "", nil
 	}
 
-	// If PR is required but not found, error
 	if opts.RequirePR && pr == nil {
 		return "", fmt.Errorf("no open pull request found for branch %s", branch)
 	}
-
-	// Return PR URL if found (empty string if not found)
 	if pr != nil {
 		return pr.HTMLURL, nil
 	}
-
 	return "", nil
 }
 
-// verifyCommitOnBranch verifies that a commit exists on a branch using the compare API
+func (c *Client) verifyCommitForMode(owner, repo, branch, commitHash, branchHeadSHA, mode string) error {
+	switch mode {
+	case settings.VerifyGitCommitModeLatest:
+		if !strings.EqualFold(strings.TrimSpace(branchHeadSHA), strings.TrimSpace(commitHash)) {
+			return fmt.Errorf(
+				"commit %s is not the latest commit on branch %s (latest: %s)",
+				commitHash,
+				branch,
+				branchHeadSHA,
+			)
+		}
+		return nil
+	case settings.VerifyGitCommitModeBranch:
+		return c.verifyCommitOnBranch(owner, repo, branch, commitHash, branchHeadSHA)
+	default:
+		return fmt.Errorf(
+			"invalid verify_git_commit_mode: %s (must be '%s' or '%s')",
+			mode,
+			settings.VerifyGitCommitModeBranch,
+			settings.VerifyGitCommitModeLatest,
+		)
+	}
+}
+
+// compareResponse is the subset of GitHub's compare API response used to check ancestry.
+type compareResponse struct {
+	Status string `json:"status"` // "ahead", "behind", "identical" or "diverged"
+}
+
+// verifyCommitOnBranch verifies that a commit is on a branch: it must be the branch head or one of
+// its ancestors. GET /repos/{owner}/{repo}/compare/{head}...{commit} reports the commit as "behind"
+// (ancestor) or "identical" (head) in that case; "ahead" or "diverged" means it is not on the branch.
+// The API returns 200 for any two commits in the repository, so the status must be checked.
 func (c *Client) verifyCommitOnBranch(owner, repo, branch, commitHash, branchHeadSHA string) error {
-	// Use GitHub compare API to check if commit is an ancestor of the branch head
-	// API: GET /repos/{owner}/{repo}/compare/{basehead}
-	// If commit is on the branch, the compare will show it's behind or identical
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/compare/%s...%s", owner, repo, commitHash, branchHeadSHA)
+	apiURL := c.repoURL(owner, repo, "compare", branchHeadSHA+"..."+commitHash)
 
+	var result compareResponse
 	notFoundError := fmt.Sprintf("commit %s not found or not on branch %s", commitHash, branch)
-	return c.doRequest("GET", url, nil, http.StatusOK, notFoundError, nil)
+	if err := c.doRequest("GET", apiURL, nil, http.StatusOK, notFoundError, &result); err != nil {
+		return err
+	}
+	switch result.Status {
+	case "behind", "identical":
+		return nil
+	default:
+		return fmt.Errorf("commit %s is not on branch %s (compare status: %q)", commitHash, branch, result.Status)
+	}
 }
 
 // getBranch fetches branch information from GitHub
 func (c *Client) getBranch(owner, repo, branch string) (*Branch, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/branches/%s", owner, repo, branch)
+	apiURL := c.repoURL(owner, repo, "branches", branch)
 
 	var branchInfo Branch
 	notFoundError := fmt.Sprintf("branch %s not found in repository %s/%s", branch, owner, repo)
-	if err := c.doRequest("GET", url, nil, http.StatusOK, notFoundError, &branchInfo); err != nil {
+	if err := c.doRequest("GET", apiURL, nil, http.StatusOK, notFoundError, &branchInfo); err != nil {
 		return nil, err
 	}
 
@@ -240,10 +265,11 @@ func (c *Client) getBranch(owner, repo, branch string) (*Branch, error) {
 
 // findPRForBranch finds an open PR for the specified branch
 func (c *Client) findPRForBranch(owner, repo, branch string) (*PullRequest, error) {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/pulls?head=%s:%s&state=open", owner, repo, owner, branch)
+	query := url.Values{"head": {owner + ":" + branch}, "state": {"open"}}
+	apiURL := c.repoURL(owner, repo, "pulls") + "?" + query.Encode()
 
 	var prs []PullRequest
-	if err := c.doRequest("GET", url, nil, http.StatusOK, "", &prs); err != nil {
+	if err := c.doRequest("GET", apiURL, nil, http.StatusOK, "", &prs); err != nil {
 		return nil, err
 	}
 
@@ -256,12 +282,12 @@ func (c *Client) findPRForBranch(owner, repo, branch string) (*PullRequest, erro
 
 // PostPRComment posts a comment on a pull request
 func (c *Client) PostPRComment(owner, repo string, prNumber int, comment string) error {
-	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/issues/%d/comments", owner, repo, prNumber)
+	apiURL := c.repoURL(owner, repo, "issues", strconv.Itoa(prNumber), "comments")
 
 	body, err := json.Marshal(PRCommentRequest{Body: comment})
 	if err != nil {
 		return fmt.Errorf("failed to marshal comment: %w", err)
 	}
 
-	return c.doRequest("POST", url, strings.NewReader(string(body)), http.StatusCreated, "", nil)
+	return c.doRequest("POST", apiURL, strings.NewReader(string(body)), http.StatusCreated, "", nil)
 }
diff --git a/internal/gateway/github/verify_commit_test.go b/internal/gateway/github/verify_commit_test.go
new file mode 100644
index 00000000..83a0807c
--- /dev/null
+++ b/internal/gateway/github/verify_commit_test.go
@@ -0,0 +1,94 @@
+package github
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/DocSpring/rack-gateway/internal/gateway/settings"
+)
+
+const (
+	branchHead = "1111111111111111111111111111111111111111"
+	deployed   = "2222222222222222222222222222222222222222"
+)
+
+// newVerifyServer fakes the GitHub branches and compare APIs. compareStatus is what the compare
+// endpoint reports for {branchHead}...{deployed}.
+func newVerifyServer(t *testing.T, compareStatus string) (*Client, *[]string) {
+	t.Helper()
+	var paths []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		paths = append(paths, r.URL.EscapedPath())
+		switch {
+		case r.URL.EscapedPath() == "/repos/DocSpring/docspring/branches/feature%2Fdeploy":
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{"commit": map[string]string{"sha": branchHead}})
+		case strings.HasPrefix(r.URL.Path, "/repos/DocSpring/docspring/compare/"):
+			_ = json.NewEncoder(w).Encode(map[string]string{"status": compareStatus})
+		case strings.HasSuffix(r.URL.Path, "/pulls") && r.URL.Query().Get("head") == "DocSpring:feature/deploy":
+			prs := []map[string]string{{"html_url": "https://github.com/DocSpring/docspring/pull/7"}}
+			_ = json.NewEncoder(w).Encode(prs)
+		case strings.HasSuffix(r.URL.Path, "/pulls"):
+			_, _ = w.Write([]byte("[]"))
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(server.Close)
+	client := NewClient("token")
+	client.apiBaseURL = server.URL
+	return client, &paths
+}
+
+func TestVerifyCommitOnBranchChecksCompareStatus(t *testing.T) {
+	opts := VerifyCommitOptions{Mode: settings.VerifyGitCommitModeBranch}
+	for status, wantOK := range map[string]bool{
+		"behind":    true, // deployed commit is an ancestor of the branch head
+		"identical": true, // deployed commit is the branch head
+		"ahead":     false,
+		"diverged":  false, // e.g. a commit from another branch or a fork
+	} {
+		client, paths := newVerifyServer(t, status)
+		_, err := client.VerifyCommitAndFindPR("DocSpring", "docspring", "feature/deploy", deployed, opts)
+		if wantOK {
+			require.NoErrorf(t, err, "status %s", status)
+		} else {
+			require.ErrorContainsf(t, err, "is not on branch", "status %s", status)
+		}
+		require.Contains(t, *paths, "/repos/DocSpring/docspring/compare/"+branchHead+"..."+deployed)
+	}
+}
+
+func TestVerifyLatestCommitRequiresExactSHA(t *testing.T) {
+	opts := VerifyCommitOptions{Mode: settings.VerifyGitCommitModeLatest}
+	client, _ := newVerifyServer(t, "identical")
+
+	_, err := client.VerifyCommitAndFindPR("DocSpring", "docspring", "feature/deploy", branchHead, opts)
+	require.NoError(t, err)
+
+	for _, commit := range []string{branchHead[:7], "1", deployed} {
+		_, err = client.VerifyCommitAndFindPR("DocSpring", "docspring", "feature/deploy", commit, opts)
+		require.ErrorContainsf(t, err, "is not the latest commit", "commit %q", commit)
+	}
+}
+
+func TestBranchNamesArePathEscaped(t *testing.T) {
+	client, paths := newVerifyServer(t, "behind")
+	prURL, err := client.VerifyCommitAndFindPR(
+		"DocSpring", "docspring", "feature/deploy", deployed,
+		VerifyCommitOptions{Mode: settings.VerifyGitCommitModeBranch, RequirePR: true},
+	)
+	require.NoError(t, err)
+	require.Equal(t, "https://github.com/DocSpring/docspring/pull/7", prURL)
+	require.Contains(t, *paths, "/repos/DocSpring/docspring/branches/feature%2Fdeploy")
+
+	_, err = client.VerifyCommitAndFindPR(
+		"DocSpring", "docspring", "../../other/repo", deployed,
+		VerifyCommitOptions{Mode: settings.VerifyGitCommitModeBranch},
+	)
+	require.Error(t, err, "path traversal in a branch name must not reach another endpoint")
+}
diff --git a/internal/gateway/handlers/admin_jobs.go b/internal/gateway/handlers/admin_jobs.go
index 62bcdb93..fa7188c3 100644
--- a/internal/gateway/handlers/admin_jobs.go
+++ b/internal/gateway/handlers/admin_jobs.go
@@ -340,21 +340,12 @@ func toJobResponse(job *rivertype.JobRow) JobResponse {
 		lastError = job.Errors[len(job.Errors)-1].Error
 	}
 
-	// Decode args from byte array to JSON
-	// The args are stored as bytes in the database, we just pass them through as-is
-	// and let JSON marshal handle the conversion
-	var args json.RawMessage
-	if len(job.EncodedArgs) > 0 {
-		// River stores args as JSON bytes, we just return them as JSON
-		args = job.EncodedArgs
-	}
-
 	return JobResponse{
 		ID:          job.ID,
 		State:       string(job.State),
 		Queue:       job.Queue,
 		Kind:        job.Kind,
-		Args:        args,
+		Args:        redactJobArgs(job.EncodedArgs),
 		Attempt:     job.Attempt,
 		MaxAttempts: job.MaxAttempts,
 		CreatedAt:   job.CreatedAt,
diff --git a/internal/gateway/handlers/deploy_approval_admin.go b/internal/gateway/handlers/deploy_approval_admin.go
index 81a85fc9..ea3e7862 100644
--- a/internal/gateway/handlers/deploy_approval_admin.go
+++ b/internal/gateway/handlers/deploy_approval_admin.go
@@ -311,12 +311,22 @@ func (h *AdminHandler) enqueueCircleCIApprovalJob(c *gin.Context, record *db.Dep
 		return
 	}
 
+	// The worker only approves the hold job if the workflow's pipeline builds the approved commit
+	// of the app's repository; ci_metadata is supplied by the requester and isn't trusted on its own.
+	vcsRepo, err := getAppSettingString(h.settingsService, record.App, settings.KeyVCSRepo, "")
+	if err != nil {
+		log.Printf("WARN: Failed to get vcs_repo setting: %v", err)
+		return
+	}
+
 	if h.jobsClient != nil {
 		_, err := h.jobsClient.Insert(c.Request.Context(), jobcircleci.ApproveJobArgs{
-			CircleCIToken:   h.config.CircleCIToken,
-			WorkflowID:      circleciMetadata.WorkflowID,
-			PipelineNumber:  circleciMetadata.PipelineNumber,
-			ApprovalJobName: circleciMetadata.ApprovalJobName,
+			WorkflowID:              circleciMetadata.WorkflowID,
+			PipelineNumber:          circleciMetadata.PipelineNumber,
+			ApprovalJobName:         circleciMetadata.ApprovalJobName,
+			DeployApprovalRequestID: record.ID,
+			ExpectedRevision:        record.GitCommitHash,
+			ExpectedRepo:            vcsRepo,
 		}, &river.InsertOpts{
 			Queue:       jobs.QueueIntegrations,
 			MaxAttempts: jobs.MaxAttemptsNotification,
diff --git a/internal/gateway/handlers/deploy_approval_notification.go b/internal/gateway/handlers/deploy_approval_notification.go
index 665b5547..917133ac 100644
--- a/internal/gateway/handlers/deploy_approval_notification.go
+++ b/internal/gateway/handlers/deploy_approval_notification.go
@@ -104,11 +104,10 @@ func (h *APIHandler) enqueueGitHubComment(c *gin.Context, owner, repo string, pr
 	}
 
 	_, err := h.jobsClient.Insert(c.Request.Context(), jobgithub.PostPRCommentArgs{
-		GitHubToken: h.config.GitHubToken,
-		Owner:       owner,
-		Repo:        repo,
-		PRNumber:    prNumber,
-		Comment:     comment,
+		Owner:    owner,
+		Repo:     repo,
+		PRNumber: prNumber,
+		Comment:  comment,
 	}, &river.InsertOpts{
 		Queue:       jobs.QueueIntegrations,
 		MaxAttempts: jobs.MaxAttemptsNotification,
diff --git a/internal/gateway/handlers/deploy_approval_requests_mfa_test.go b/internal/gateway/handlers/deploy_approval_requests_mfa_test.go
index 115cae46..67aae656 100644
--- a/internal/gateway/handlers/deploy_approval_requests_mfa_test.go
+++ b/internal/gateway/handlers/deploy_approval_requests_mfa_test.go
@@ -102,7 +102,7 @@ func TestApproveDeployApprovalRequest_RequiresMFACode(t *testing.T) {
 	req, err := database.CreateDeployApprovalRequest(
 		"Test deploy",
 		"test-app",
-		"abc123",
+		"abc123def4567890abc123def4567890abc123de",
 		"main",
 		"",                  // prURL
 		[]byte("{}"),        // ciMetadata - must be valid JSON
@@ -170,7 +170,7 @@ func TestApproveDeployApprovalRequest_RequiresMFACode(t *testing.T) {
 		req2, err := database.CreateDeployApprovalRequest(
 			"Test deploy 2",
 			"test-app-2",
-			"def456",
+			"def4567890abc123def4567890abc123def45678",
 			"main",
 			"",                  // prURL
 			[]byte("{}"),        // ciMetadata - must be valid JSON
diff --git a/internal/gateway/handlers/deploy_approval_requests_test.go b/internal/gateway/handlers/deploy_approval_requests_test.go
index 56fc29ad..91a26463 100644
--- a/internal/gateway/handlers/deploy_approval_requests_test.go
+++ b/internal/gateway/handlers/deploy_approval_requests_test.go
@@ -14,10 +14,18 @@ import (
 	"github.com/DocSpring/rack-gateway/internal/gateway/audit"
 	"github.com/DocSpring/rack-gateway/internal/gateway/auth"
 	"github.com/DocSpring/rack-gateway/internal/gateway/config"
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
 	"github.com/DocSpring/rack-gateway/internal/gateway/testutil/dbtest"
 )
 
-func TestCreateDeployApprovalRequestResolvesTargetTokenByPublicID(t *testing.T) {
+type createApprovalFixture struct {
+	handler *APIHandler
+	user    *db.User
+	token   *db.APIToken
+}
+
+func newCreateApprovalFixture(t *testing.T) *createApprovalFixture {
+	t.Helper()
 	gin.SetMode(gin.TestMode)
 	database := dbtest.NewDatabase(t)
 
@@ -35,53 +43,63 @@ func TestCreateDeployApprovalRequestResolvesTargetTokenByPublicID(t *testing.T)
 	require.NoError(t, err)
 	require.NotEmpty(t, token.PublicID)
 
-	auditLogger := audit.NewLogger(database)
 	handler := &APIHandler{
 		rbac:        newAllowAllRBAC(user),
 		database:    database,
-		auditLogger: auditLogger,
+		auditLogger: audit.NewLogger(database),
 		config: &config.Config{Racks: map[string]config.RackConfig{
 			"default": {Name: "staging", Enabled: true},
 		}},
 	}
+	return &createApprovalFixture{handler: handler, user: user, token: token}
+}
 
-	body := map[string]string{
+func (f *createApprovalFixture) create(t *testing.T, commit string) *http.Response {
+	t.Helper()
+	payload, err := json.Marshal(map[string]string{
 		"message":             "Deploy release",
 		"app":                 "myapp",
-		"git_commit_hash":     "abc123def456",
-		"git_branch":          "main",
-		"target_api_token_id": token.PublicID,
-	}
-	payload, err := json.Marshal(body)
+		"git_commit_hash":     commit,
+		"git_branch":          "feature/deploy",
+		"target_api_token_id": f.token.PublicID,
+	})
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodPost, "/deploy-approval-requests", strings.NewReader(string(payload)))
 	req.Header.Set("Content-Type", "application/json")
 	req = req.WithContext(context.WithValue(req.Context(), auth.UserContextKey, &auth.User{
-		Email:      user.Email,
-		Name:       user.Name,
+		Email:      f.user.Email,
+		Name:       f.user.Name,
 		IsAPIToken: true,
-		TokenID:    &token.ID,
+		TokenID:    &f.token.ID,
 	}))
 
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = req
-	c.Set("user_email", user.Email)
+	c.Set("user_email", f.user.Email)
 
-	handler.CreateDeployApprovalRequest(c)
+	f.handler.CreateDeployApprovalRequest(c)
 
 	resp := w.Result()
-	defer func() {
-		if err := resp.Body.Close(); err != nil {
-			t.Errorf("failed to close response body: %v", err)
-		}
-	}()
+	t.Cleanup(func() { _ = resp.Body.Close() })
+	return resp
+}
 
+func TestCreateDeployApprovalRequestResolvesTargetTokenByPublicID(t *testing.T) {
+	f := newCreateApprovalFixture(t)
+	resp := f.create(t, "abc123def4567890abc123def4567890abc123de")
 	require.Equal(t, http.StatusCreated, resp.StatusCode)
 
 	var got DeployApprovalRequestResponse
-	err = json.NewDecoder(resp.Body).Decode(&got)
-	require.NoError(t, err)
-	require.Equal(t, token.PublicID, got.TargetAPITokenID)
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&got))
+	require.Equal(t, f.token.PublicID, got.TargetAPITokenID)
+}
+
+func TestCreateDeployApprovalRequestRequiresFullCommitSHA(t *testing.T) {
+	f := newCreateApprovalFixture(t)
+	for _, commit := range []string{"abc123d", "abc123def456", "%", strings.Repeat("z", 40)} {
+		resp := f.create(t, commit)
+		require.Equalf(t, http.StatusBadRequest, resp.StatusCode, "commit %q", commit)
+	}
 }
diff --git a/internal/gateway/handlers/deploy_approval_validation.go b/internal/gateway/handlers/deploy_approval_validation.go
index 193bc9fd..dd7edb90 100644
--- a/internal/gateway/handlers/deploy_approval_validation.go
+++ b/internal/gateway/handlers/deploy_approval_validation.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
 	"github.com/DocSpring/rack-gateway/internal/gateway/httpclient"
 	gtwlog "github.com/DocSpring/rack-gateway/internal/gateway/logging"
 )
@@ -74,9 +75,9 @@ func (h *APIHandler) validateRequestFields(
 		return "", "", "", false
 	}
 
-	gitCommitHash := strings.TrimSpace(req.GitCommitHash)
-	if gitCommitHash == "" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "git_commit_hash is required"})
+	gitCommitHash, ok := db.NormalizeCommitSHA(req.GitCommitHash)
+	if !ok {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "git_commit_hash must be a full 40-character commit SHA"})
 		return "", "", "", false
 	}
 
diff --git a/internal/gateway/handlers/job_args_redaction.go b/internal/gateway/handlers/job_args_redaction.go
new file mode 100644
index 00000000..392b80c9
--- /dev/null
+++ b/internal/gateway/handlers/job_args_redaction.go
@@ -0,0 +1,60 @@
+package handlers
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+const redactedJobArg = "[REDACTED]"
+
+var sensitiveJobArgKeyParts = []string{"token", "secret", "password", "key"}
+
+// redactJobArgs replaces the value of every object key that looks secret (contains token, secret,
+// password or key) before job arguments are returned by the jobs API. Workers no longer receive
+// credentials through job arguments; this is defense in depth for older rows and future mistakes.
+// Arguments that cannot be parsed are withheld rather than passed through.
+func redactJobArgs(raw json.RawMessage) json.RawMessage {
+	if len(raw) == 0 {
+		return nil
+	}
+	var decoded interface{}
+	if err := json.Unmarshal(raw, &decoded); err != nil {
+		return nil
+	}
+	redacted, err := json.Marshal(redactJobArgValue(decoded))
+	if err != nil {
+		return nil
+	}
+	return redacted
+}
+
+func redactJobArgValue(value interface{}) interface{} {
+	switch typed := value.(type) {
+	case map[string]interface{}:
+		for key, nested := range typed {
+			if isSensitiveJobArgKey(key) {
+				typed[key] = redactedJobArg
+				continue
+			}
+			typed[key] = redactJobArgValue(nested)
+		}
+		return typed
+	case []interface{}:
+		for i, nested := range typed {
+			typed[i] = redactJobArgValue(nested)
+		}
+		return typed
+	default:
+		return value
+	}
+}
+
+func isSensitiveJobArgKey(key string) bool {
+	lower := strings.ToLower(key)
+	for _, part := range sensitiveJobArgKeyParts {
+		if strings.Contains(lower, part) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/gateway/handlers/job_args_redaction_test.go b/internal/gateway/handlers/job_args_redaction_test.go
new file mode 100644
index 00000000..f1ddd2b6
--- /dev/null
+++ b/internal/gateway/handlers/job_args_redaction_test.go
@@ -0,0 +1,42 @@
+package handlers
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedactJobArgs(t *testing.T) {
+	raw := json.RawMessage(`{
+		"circleci_token": "circle-secret",
+		"github_token": "ghp_secret",
+		"workflow_id": "11111111-2222-3333-4444-555555555555",
+		"nested": {"api_key": "k", "password": "p", "count": 3},
+		"items": [{"client_secret": "s", "name": "ok"}]
+	}`)
+
+	redacted := redactJobArgs(raw)
+	require.NotNil(t, redacted)
+	assert.NotContains(t, string(redacted), "circle-secret")
+	assert.NotContains(t, string(redacted), "ghp_secret")
+
+	var decoded map[string]interface{}
+	require.NoError(t, json.Unmarshal(redacted, &decoded))
+	assert.Equal(t, redactedJobArg, decoded["circleci_token"])
+	assert.Equal(t, redactedJobArg, decoded["github_token"])
+	assert.Equal(t, "11111111-2222-3333-4444-555555555555", decoded["workflow_id"])
+	nested := decoded["nested"].(map[string]interface{})
+	assert.Equal(t, redactedJobArg, nested["api_key"])
+	assert.Equal(t, redactedJobArg, nested["password"])
+	assert.InDelta(t, 3, nested["count"], 0)
+	item := decoded["items"].([]interface{})[0].(map[string]interface{})
+	assert.Equal(t, redactedJobArg, item["client_secret"])
+	assert.Equal(t, "ok", item["name"])
+}
+
+func TestRedactJobArgsWithholdsUnparseableArgs(t *testing.T) {
+	assert.Nil(t, redactJobArgs(json.RawMessage(`not json "token":"x"`)))
+	assert.Nil(t, redactJobArgs(nil))
+}
diff --git a/internal/gateway/jobs/circleci/approve.go b/internal/gateway/jobs/circleci/approve.go
index 57f239d9..0a4ae499 100644
--- a/internal/gateway/jobs/circleci/approve.go
+++ b/internal/gateway/jobs/circleci/approve.go
@@ -2,6 +2,7 @@ package circleci
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -10,13 +11,17 @@ import (
 	"github.com/DocSpring/rack-gateway/internal/gateway/circleci"
 )
 
-// ApproveJobArgs contains parameters for CircleCI job approval
+// ApproveJobArgs contains parameters for CircleCI job approval.
+// The CircleCI API token is held by the worker and never stored in job arguments.
 type ApproveJobArgs struct {
 	WorkflowID              string `json:"workflow_id"`
 	PipelineNumber          string `json:"pipeline_number"`
 	ApprovalJobName         string `json:"approval_job_name"`
-	CircleCIToken           string `json:"circleci_token"`
 	DeployApprovalRequestID int64  `json:"deploy_approval_request_id"`
+	// ExpectedRevision is the approved commit; the workflow's pipeline must be building it.
+	ExpectedRevision string `json:"expected_revision"`
+	// ExpectedRepo is the app's "owner/repo"; when set, the pipeline must be for this repository.
+	ExpectedRepo string `json:"expected_repo,omitempty"`
 }
 
 // Kind returns the unique identifier for this job type
@@ -25,22 +30,26 @@ func (ApproveJobArgs) Kind() string { return "circleci:approve_job" }
 // ApproveJobWorker approves CircleCI jobs
 type ApproveJobWorker struct {
 	river.WorkerDefaults[ApproveJobArgs]
+	token string
 }
 
-// NewApproveJobWorker creates a new CircleCI approve job worker
-func NewApproveJobWorker() *ApproveJobWorker {
-	return &ApproveJobWorker{}
+// NewApproveJobWorker creates a new CircleCI approve job worker using the given API token.
+func NewApproveJobWorker(token string) *ApproveJobWorker {
+	return &ApproveJobWorker{token: token}
 }
 
-// Work approves the CircleCI job
-func (_ *ApproveJobWorker) Work(_ context.Context, job *river.Job[ApproveJobArgs]) error {
+// Work approves the CircleCI job after verifying its pipeline matches the deploy approval.
+func (w *ApproveJobWorker) Work(_ context.Context, job *river.Job[ApproveJobArgs]) error {
+	if strings.TrimSpace(w.token) == "" {
+		return river.JobCancel(fmt.Errorf("CircleCI token not configured"))
+	}
 	args := job.Args
+	client := circleci.NewClient(w.token)
+	expect := circleci.ApprovalExpectation{Revision: args.ExpectedRevision, Repo: args.ExpectedRepo}
 
-	// Create client with token from job args
-	client := circleci.NewClient(args.CircleCIToken)
-
-	if err := client.ApproveJob(args.WorkflowID, args.PipelineNumber, args.ApprovalJobName); err != nil {
+	if err := client.ApproveJob(args.WorkflowID, args.PipelineNumber, args.ApprovalJobName, expect); err != nil {
 		// Don't retry if the job is in an invalid state (canceled, already approved, etc.)
+		// or the workflow doesn't belong to the approved commit (leave it for a manual approval).
 		if isNonRetryableError(err) {
 			return river.JobCancel(fmt.Errorf("CircleCI job approval failed (non-retryable): %w", err))
 		}
@@ -55,6 +64,9 @@ func isNonRetryableError(err error) bool {
 	if err == nil {
 		return false
 	}
+	if errors.Is(err, circleci.ErrPipelineMismatch) || errors.Is(err, circleci.ErrInvalidWorkflowID) {
+		return true
+	}
 	errStr := err.Error()
 	// "Invalid approval job state" - job was canceled or already processed
 	// "approval job not found" - job doesn't exist anymore
diff --git a/internal/gateway/jobs/circleci/approve_test.go b/internal/gateway/jobs/circleci/approve_test.go
index 57e8fcf1..b08b4c8d 100644
--- a/internal/gateway/jobs/circleci/approve_test.go
+++ b/internal/gateway/jobs/circleci/approve_test.go
@@ -1,26 +1,43 @@
 package circleci
 
 import (
+	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/DocSpring/rack-gateway/internal/gateway/circleci"
 )
 
 // Test ApproveJobArgs.Kind
 func TestApproveJobArgs_Kind(t *testing.T) {
 	args := ApproveJobArgs{
-		WorkflowID:              "abc123-workflow-id",
+		WorkflowID:              "11111111-2222-3333-4444-555555555555",
 		PipelineNumber:          "6445",
 		ApprovalJobName:         "hold-for-approval",
-		CircleCIToken:           "circle-token-secret",
 		DeployApprovalRequestID: 789,
 	}
 	assert.Equal(t, "circleci:approve_job", args.Kind())
 }
 
+// The CircleCI token must never be persisted in job arguments (they are stored in river_job.args
+// and returned by the jobs API).
+func TestApproveJobArgs_DoNotContainToken(t *testing.T) {
+	encoded, err := json.Marshal(ApproveJobArgs{WorkflowID: "w", ExpectedRevision: "r"})
+	require.NoError(t, err)
+	assert.NotContains(t, string(encoded), "token")
+}
+
 // Test NewApproveJobWorker
 func TestNewApproveJobWorker(t *testing.T) {
-	worker := NewApproveJobWorker()
+	worker := NewApproveJobWorker("token")
 	require.NotNil(t, worker)
 }
+
+func TestPipelineMismatchIsNonRetryable(t *testing.T) {
+	assert.True(t, isNonRetryableError(fmt.Errorf("wrapped: %w", circleci.ErrPipelineMismatch)))
+	assert.True(t, isNonRetryableError(fmt.Errorf("wrapped: %w", circleci.ErrInvalidWorkflowID)))
+	assert.False(t, isNonRetryableError(fmt.Errorf("CircleCI API error (502): bad gateway")))
+}
diff --git a/internal/gateway/jobs/client.go b/internal/gateway/jobs/client.go
index 336cc51e..dec5b0ee 100644
--- a/internal/gateway/jobs/client.go
+++ b/internal/gateway/jobs/client.go
@@ -38,6 +38,10 @@ type Dependencies struct {
 	Database      *db.Database
 	EmailSender   email.Sender
 	SlackNotifier *slack.Notifier
+	// CircleCIToken and GitHubToken are used by the CI/GitHub workers. They are never stored in job
+	// arguments, which are persisted in river_job and returned by the jobs API.
+	CircleCIToken string
+	GitHubToken   string
 }
 
 // AuditAnchorConfig holds configuration for WORM S3 anchor writer
@@ -87,8 +91,8 @@ func NewClient(pool *pgxpool.Pool, deps *Dependencies, auditAnchorConfig *AuditA
 	river.AddWorker(workers, jobslack.NewDeployApprovalWorker(deps.Database, deps.SlackNotifier))
 
 	// CI/GitHub workers
-	river.AddWorker(workers, jobcircleci.NewApproveJobWorker())
-	river.AddWorker(workers, jobgithub.NewPostPRCommentWorker())
+	river.AddWorker(workers, jobcircleci.NewApproveJobWorker(deps.CircleCIToken))
+	river.AddWorker(workers, jobgithub.NewPostPRCommentWorker(deps.GitHubToken))
 
 	// Setup periodic jobs
 	var periodicJobs []*river.PeriodicJob
diff --git a/internal/gateway/jobs/github/pr_comment.go b/internal/gateway/jobs/github/pr_comment.go
index 0de74a4f..3897424b 100644
--- a/internal/gateway/jobs/github/pr_comment.go
+++ b/internal/gateway/jobs/github/pr_comment.go
@@ -3,19 +3,20 @@ package github
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/riverqueue/river"
 
 	"github.com/DocSpring/rack-gateway/internal/gateway/github"
 )
 
-// PostPRCommentArgs contains parameters for posting GitHub PR comments
+// PostPRCommentArgs contains parameters for posting GitHub PR comments.
+// The GitHub token is held by the worker and never stored in job arguments.
 type PostPRCommentArgs struct {
 	Owner                   string `json:"owner"`
 	Repo                    string `json:"repo"`
 	PRNumber                int    `json:"pr_number"`
 	Comment                 string `json:"comment"`
-	GitHubToken             string `json:"github_token"`
 	DeployApprovalRequestID int64  `json:"deploy_approval_request_id"`
 }
 
@@ -25,19 +26,21 @@ func (PostPRCommentArgs) Kind() string { return "github:post_pr_comment" }
 // PostPRCommentWorker posts comments to GitHub pull requests
 type PostPRCommentWorker struct {
 	river.WorkerDefaults[PostPRCommentArgs]
+	token string
 }
 
-// NewPostPRCommentWorker creates a new GitHub PR comment worker
-func NewPostPRCommentWorker() *PostPRCommentWorker {
-	return &PostPRCommentWorker{}
+// NewPostPRCommentWorker creates a new GitHub PR comment worker using the given API token.
+func NewPostPRCommentWorker(token string) *PostPRCommentWorker {
+	return &PostPRCommentWorker{token: token}
 }
 
 // Work posts the PR comment
-func (_ *PostPRCommentWorker) Work(_ context.Context, job *river.Job[PostPRCommentArgs]) error {
+func (w *PostPRCommentWorker) Work(_ context.Context, job *river.Job[PostPRCommentArgs]) error {
+	if strings.TrimSpace(w.token) == "" {
+		return river.JobCancel(fmt.Errorf("GitHub token not configured"))
+	}
 	args := job.Args
-
-	// Create client with token from job args
-	client := github.NewClient(args.GitHubToken)
+	client := github.NewClient(w.token)
 
 	if err := client.PostPRComment(args.Owner, args.Repo, args.PRNumber, args.Comment); err != nil {
 		return fmt.Errorf("failed to post GitHub PR comment: %w", err)
diff --git a/internal/gateway/jobs/github/pr_comment_test.go b/internal/gateway/jobs/github/pr_comment_test.go
index f8c7b887..30f9251b 100644
--- a/internal/gateway/jobs/github/pr_comment_test.go
+++ b/internal/gateway/jobs/github/pr_comment_test.go
@@ -1,6 +1,7 @@
 package github
 
 import (
+	"encoding/json"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -14,14 +15,20 @@ func TestPostPRCommentArgs_Kind(t *testing.T) {
 		Repo:                    "myrepo",
 		PRNumber:                123,
 		Comment:                 "Deployment approved",
-		GitHubToken:             "ghp_secret",
 		DeployApprovalRequestID: 456,
 	}
 	assert.Equal(t, "github:post_pr_comment", args.Kind())
 }
 
+// The GitHub token must never be persisted in job arguments.
+func TestPostPRCommentArgs_DoNotContainToken(t *testing.T) {
+	encoded, err := json.Marshal(PostPRCommentArgs{Owner: "o", Repo: "r", PRNumber: 1, Comment: "c"})
+	require.NoError(t, err)
+	assert.NotContains(t, string(encoded), "token")
+}
+
 // Test NewPostPRCommentWorker
 func TestNewPostPRCommentWorker(t *testing.T) {
-	worker := NewPostPRCommentWorker()
+	worker := NewPostPRCommentWorker("token")
 	require.NotNil(t, worker)
 }
diff --git a/internal/gateway/proxy/approval_resolvers.go b/internal/gateway/proxy/approval_resolvers.go
new file mode 100644
index 00000000..930d5067
--- /dev/null
+++ b/internal/gateway/proxy/approval_resolvers.go
@@ -0,0 +1,309 @@
+package proxy
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
+	gtwlog "github.com/DocSpring/rack-gateway/internal/gateway/logging"
+	"github.com/DocSpring/rack-gateway/internal/gateway/rbac"
+)
+
+// Approval resolvers find the deploy approval request that authorizes an approval-gated
+// Convox request for an API token. Each step of a deploy is bound to the previous one:
+// object upload -> build (by uploaded object URL) -> release (by build) -> processes (by release).
+
+type denyFunc func() (bool, *deployApprovalTracker, error)
+
+func (h *Handler) findDeployApprovalForResource(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+	resource rbac.Resource,
+	action rbac.Action,
+) (*db.DeployApprovalRequest, error) {
+	if resolver := h.approvalResolverFor(resource, action, r.URL.Path); resolver != nil {
+		return resolver(r, deny, tokenID, app)
+	}
+	return nil, fmt.Errorf("unsupported deploy approval resource/action: %s:%s", resource, action)
+}
+
+type approvalResolver func(*http.Request, denyFunc, int64, string) (*db.DeployApprovalRequest, error)
+
+func (h *Handler) approvalResolverFor(resource rbac.Resource, action rbac.Action, path string) approvalResolver {
+	key := resource.String() + ":" + action.String()
+	table := map[string]approvalResolver{
+		rbac.ResourceObject.String() + ":" + rbac.ActionCreate.String(): func(
+			_ *http.Request,
+			_ denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForObjectCreate(tokenID, app)
+		},
+		rbac.ResourceBuild.String() + ":" + rbac.ActionCreate.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForBuildCreate(r, deny, tokenID, app)
+		},
+		rbac.ResourceBuild.String() + ":" + rbac.ActionRead.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForBuildRead(r, deny, tokenID, app)
+		},
+		rbac.ResourceProcess.String() + ":" + rbac.ActionStart.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForProcessStart(r, deny, tokenID, app)
+		},
+		rbac.ResourceProcess.String() + ":" + rbac.ActionExec.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForProcessAction(r, deny, tokenID, app, rbac.ActionExec)
+		},
+		rbac.ResourceProcess.String() + ":" + rbac.ActionTerminate.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForProcessAction(r, deny, tokenID, app, rbac.ActionTerminate)
+		},
+		rbac.ResourceRelease.String() + ":" + rbac.ActionRead.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForReleaseRead(r, deny, tokenID, app)
+		},
+		rbac.ResourceRelease.String() + ":" + rbac.ActionPromote.String(): func(
+			r *http.Request,
+			deny denyFunc,
+			tokenID int64,
+			app string,
+		) (*db.DeployApprovalRequest, error) {
+			return h.findApprovalForReleasePromote(r, deny, tokenID, app)
+		},
+	}
+	// Special case: logs read only applies when path is build logs
+	if resource == rbac.ResourceLog && action == rbac.ActionRead && isBuildLogPath(path) {
+		return table[rbac.ResourceBuild.String()+":"+rbac.ActionRead.String()]
+	}
+	return table[key]
+}
+
+func (h *Handler) findApprovalForObjectCreate(
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	req, err := h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
+		TokenID:      tokenID,
+		App:          app,
+		StatusFilter: "approved",
+	})
+	// Fail if object_url is already set - this means an object was already uploaded for this approval.
+	// Object uploads should only happen once per approval (unlike builds, which can fail and retry).
+	if err == nil && req != nil && req.ObjectURL != "" {
+		return nil, &deployApprovalError{
+			status:  http.StatusConflict,
+			message: "an archive has already been uploaded for this deploy approval request",
+		}
+	}
+	return req, err
+}
+
+// findApprovalForBuildCreate selects the approval whose uploaded archive this build uses.
+// A token build can only build the object that was uploaded under its own approved request.
+func (h *Handler) findApprovalForBuildCreate(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	objectURL, err := buildRequestObjectURL(r)
+	if err != nil {
+		return nil, err
+	}
+	if objectURL == "" {
+		_, _, denyErr := deny()
+		return nil, denyErr
+	}
+	req, err := h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
+		TokenID:      tokenID,
+		App:          app,
+		ObjectURL:    objectURL,
+		StatusFilter: "approved",
+	})
+	if err == nil && req != nil && (req.BuildID != "" || req.ReleaseID != "") {
+		return nil, &deployApprovalError{
+			status:  http.StatusConflict,
+			message: "a build has already been created for this deploy approval request",
+		}
+	}
+	return req, err
+}
+
+// buildRequestObjectURL reads the object URL from a form-encoded build request and restores the body.
+func buildRequestObjectURL(r *http.Request) (string, error) {
+	if r.Body == nil {
+		return "", nil
+	}
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		return "", fmt.Errorf("failed to read build request: %w", err)
+	}
+	r.Body = io.NopCloser(bytes.NewReader(body))
+	vals, err := url.ParseQuery(string(body))
+	if err != nil {
+		return "", &deployApprovalError{status: http.StatusBadRequest, message: "invalid build request body"}
+	}
+	return strings.TrimSpace(vals.Get("url")), nil
+}
+
+func (h *Handler) findApprovalForBuildRead(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	buildID := extractBuildIDFromPath(r.URL.Path)
+	if buildID == "" {
+		_, _, err := deny()
+		return nil, err
+	}
+	return h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
+		TokenID:      tokenID,
+		App:          app,
+		BuildID:      buildID,
+		StatusFilter: "approved",
+	})
+}
+
+func (h *Handler) findApprovalForProcessStart(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	releaseID := r.Header.Get("Release")
+	if releaseID == "" {
+		_, _, err := deny()
+		return nil, err
+	}
+	return h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
+		TokenID:      tokenID,
+		App:          app,
+		ReleaseID:    releaseID,
+		StatusFilter: "approved",
+	})
+}
+
+func (h *Handler) findApprovalForProcessAction(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+	action rbac.Action,
+) (*db.DeployApprovalRequest, error) {
+	processID := extractProcessIDFromPath(r.URL.Path)
+	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval,
+		"process %s - checking permission for tokenID=%d app=%s processID=%s",
+		action,
+		tokenID,
+		app,
+		processID,
+	)
+	if processID == "" {
+		gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - denied: empty processID", action)
+		_, _, err := deny()
+		return nil, err
+	}
+	lookup := db.DeployApprovalLookup{
+		TokenID:      tokenID,
+		App:          app,
+		ProcessID:    processID,
+		StatusFilter: "approved",
+	}
+	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - looking up deploy approval: %+v", action, lookup)
+	req, err := h.database.FindDeployApprovalRequest(lookup)
+	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - lookup result: req=%v err=%v", action, req != nil, err)
+	return req, err
+}
+
+func (h *Handler) findApprovalForReleaseRead(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	// Use the same logic as promote - extract release ID and look up approval
+	return h.findApprovalForRelease(r, deny, tokenID, app, false)
+}
+
+func (h *Handler) findApprovalForReleasePromote(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+) (*db.DeployApprovalRequest, error) {
+	// Promote needs to check for already-deployed status
+	return h.findApprovalForRelease(r, deny, tokenID, app, true)
+}
+
+func (h *Handler) findApprovalForRelease(
+	r *http.Request,
+	deny denyFunc,
+	tokenID int64,
+	app string,
+	checkDeployed bool,
+) (*db.DeployApprovalRequest, error) {
+	releaseID := extractReleaseIDFromPath(r.URL.Path)
+	if releaseID == "" {
+		_, _, err := deny()
+		return nil, err
+	}
+
+	// For promote, we need to check if already deployed, so we can't filter by status
+	// For read, we can filter by approved status for efficiency
+	lookup := db.DeployApprovalLookup{
+		TokenID:   tokenID,
+		App:       app,
+		ReleaseID: releaseID,
+	}
+	if !checkDeployed {
+		lookup.StatusFilter = "approved"
+	}
+
+	req, err := h.database.FindDeployApprovalRequest(lookup)
+	if err == nil && req != nil {
+		if checkDeployed && req.Status == db.DeployApprovalRequestStatusDeployed {
+			return nil, &deployApprovalError{
+				status:  http.StatusConflict,
+				message: "this deploy approval request has already been deployed",
+			}
+		}
+		if req.Status != db.DeployApprovalRequestStatusApproved {
+			_, _, denyErr := deny()
+			return nil, denyErr
+		}
+	}
+	return req, err
+}
diff --git a/internal/gateway/proxy/deploy_approval_binding_test.go b/internal/gateway/proxy/deploy_approval_binding_test.go
new file mode 100644
index 00000000..8bda31f0
--- /dev/null
+++ b/internal/gateway/proxy/deploy_approval_binding_test.go
@@ -0,0 +1,242 @@
+package proxy
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/DocSpring/rack-gateway/internal/gateway/auth"
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
+	"github.com/DocSpring/rack-gateway/internal/gateway/rbac"
+)
+
+const (
+	approvedCommit    = "0123456789abcdef0123456789abcdef01234567"
+	otherCommit       = "fedcba9876543210fedcba9876543210fedcba98"
+	approvedObjectURL = "object://docspring/tmp/approved.tgz"
+	buildPath         = "/apps/docspring/builds"
+)
+
+type bindingFixture struct {
+	h        *Handler
+	database *db.Database
+	authUser *auth.User
+	approval *db.DeployApprovalRequest
+	manifest string // convox.yml served inside the uploaded archive
+}
+
+func newBindingFixture(t *testing.T) *bindingFixture {
+	t.Helper()
+	f := &bindingFixture{}
+	rack := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodGet && r.URL.Path == "/apps/docspring/objects/tmp/approved.tgz" {
+			_, _ = w.Write(tarballWithManifest(t, f.manifest))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	})
+	h, database, _, cleanup := newProxyWithRackServer(t, rack)
+	t.Cleanup(cleanup)
+	f.h, f.database = h, database
+
+	owner, err := database.CreateUser("ci-owner@example.com", "CI", []string{"admin"})
+	require.NoError(t, err)
+	perms := rbac.DefaultPermissionsForRole("cicd")
+	token, err := database.CreateAPIToken(strings.Repeat("b", 64), "ci", owner.ID, perms, nil, nil)
+	require.NoError(t, err)
+	f.authUser = &auth.User{
+		Email: owner.Email, IsAPIToken: true, TokenID: &token.ID, Permissions: perms, DBUser: owner,
+	}
+
+	approval, err := database.CreateDeployApprovalRequest(
+		"Deploy", "docspring", approvedCommit, "feature/x", "", nil, owner.ID, &token.ID, token.ID,
+	)
+	require.NoError(t, err)
+	_, err = database.ApproveDeployApprovalRequest(approval.ID, owner.ID, time.Now().Add(time.Hour), "ok")
+	require.NoError(t, err)
+	require.NoError(t, database.UpdateDeployApprovalRequestObjectURL(approval.ID, approvedObjectURL))
+	f.approval = approval
+	f.setImagePatterns(t, map[string]string{"*": `docker\.io/docspringcom/app:{{GIT_COMMIT}}(-amd64)?`})
+	return f
+}
+
+// setImagePatterns configures the app's service_image_patterns (nil clears them).
+func (f *bindingFixture) setImagePatterns(t *testing.T, patterns map[string]string) {
+	t.Helper()
+	app := "docspring"
+	if patterns == nil {
+		require.NoError(t, f.database.DeleteSetting(&app, "service_image_patterns"))
+		return
+	}
+	require.NoError(t, f.database.UpsertSetting(&app, "service_image_patterns", patterns, nil))
+}
+
+// build runs the permission check and build validation the proxy performs for POST /apps/{app}/builds.
+func (f *bindingFixture) build(t *testing.T, body string) error {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodPost, buildPath, strings.NewReader(body))
+	allowed, tracker, err := f.h.evaluateAPITokenPermission(r, f.authUser, rbac.ResourceBuild, rbac.ActionCreate)
+	if err != nil {
+		return err
+	}
+	require.True(t, allowed)
+	require.NotNil(t, tracker)
+	r = r.WithContext(context.WithValue(r.Context(), deployApprovalContextKey, tracker))
+	return f.h.validateBuildRequest(r, buildPath, []byte(body), f.authUser)
+}
+
+func tarballWithManifest(t *testing.T, manifest string) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	tw := tar.NewWriter(gz)
+	require.NoError(t, tw.WriteHeader(&tar.Header{
+		Name: "convox.yml", Mode: 0o644, Size: int64(len(manifest)), Typeflag: tar.TypeReg,
+	}))
+	_, err := tw.Write([]byte(manifest))
+	require.NoError(t, err)
+	require.NoError(t, tw.Close())
+	require.NoError(t, gz.Close())
+	return buf.Bytes()
+}
+
+func imageManifest(images ...string) string {
+	var b strings.Builder
+	b.WriteString("services:\n")
+	for i, image := range images {
+		b.WriteString("  svc" + string(rune('a'+i)) + ":\n    image: " + image + "\n")
+	}
+	return b.String()
+}
+
+func TestTokenBuildAllowsImagesTaggedWithApprovedCommit(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest(
+		"docker.io/docspringcom/app:"+approvedCommit+"-amd64",
+		"docker.io/docspringcom/app:"+approvedCommit,
+	)
+	require.NoError(t, f.build(t, "url="+approvedObjectURL))
+	require.NoError(t, f.build(t, "url="+approvedObjectURL+"&git-sha="+approvedCommit))
+}
+
+func TestTokenBuildRejectsImageForAnotherCommit(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest(
+		"docker.io/docspringcom/app:"+approvedCommit+"-amd64",
+		"docker.io/docspringcom/app:"+otherCommit+"-amd64",
+	)
+	err := f.build(t, "url="+approvedObjectURL)
+	require.ErrorContains(t, err, "manifest validation failed")
+	require.ErrorContains(t, err, "not tagged with the approved commit")
+}
+
+func TestTokenBuildRejectsOtherRepositoryWithApprovedCommitTag(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest("ghcr.io/attacker/payload:" + approvedCommit + "-amd64")
+	err := f.build(t, "url="+approvedObjectURL)
+	require.ErrorContains(t, err, "does not match required pattern")
+}
+
+func TestTokenBuildRequiresImagePatterns(t *testing.T) {
+	f := newBindingFixture(t)
+	f.setImagePatterns(t, nil)
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit + "-amd64")
+	err := f.build(t, "url="+approvedObjectURL)
+	require.ErrorContains(t, err, "require service_image_patterns")
+}
+
+func TestTokenBuildRejectsServicesBuiltFromSource(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = "services:\n  web:\n    build: .\n"
+	err := f.build(t, "url="+approvedObjectURL)
+	require.ErrorContains(t, err, "must use a pre-built image")
+}
+
+func TestTokenBuildRejectsObjectNotUploadedUnderApproval(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit)
+	err := f.build(t, "url=object://docspring/tmp/attacker.tgz")
+	var approvalErr *deployApprovalError
+	require.ErrorAs(t, err, &approvalErr, "a build from another archive must not find the approval")
+	require.Equal(t, http.StatusForbidden, approvalErr.status)
+
+	// Even with the right tracker, the binding check compares the build URL to the approved object.
+	tracker := &deployApprovalTracker{request: f.approval, app: "docspring"}
+	tracker.request.ObjectURL = approvedObjectURL
+	r := httptest.NewRequest(http.MethodPost, buildPath, nil)
+	err = f.h.validateTokenBuildBinding(r, map[string][]string{"url": {"object://docspring/tmp/x.tgz"}}, tracker)
+	require.ErrorContains(t, err, "must use the archive uploaded for deploy approval")
+}
+
+func TestTokenBuildRejectsGitSHAMismatch(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit)
+	err := f.build(t, "url="+approvedObjectURL+"&git-sha="+otherCommit)
+	require.ErrorContains(t, err, "does not match the approved commit")
+}
+
+func TestTokenBuildAppliesAnchoredImagePatterns(t *testing.T) {
+	f := newBindingFixture(t)
+	app := "docspring"
+	require.NoError(t, f.database.UpsertSetting(
+		&app, "service_image_patterns", map[string]string{"*": `docker\.io/docspringcom/app:{{GIT_COMMIT}}-amd64`}, nil,
+	))
+
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit + "-amd64")
+	require.NoError(t, f.build(t, "url="+approvedObjectURL))
+
+	// Tagged with the approved commit, but from another registry: the anchored pattern rejects it.
+	f.manifest = imageManifest("ghcr.io/attacker/docker.io/docspringcom/app:" + approvedCommit + "-amd64")
+	require.ErrorContains(t, f.build(t, "url="+approvedObjectURL), "does not match required pattern")
+}
+
+func TestImagePatternsAreAnchoredAndEscapeCommit(t *testing.T) {
+	manifest := func(image string) *convoxManifest {
+		return &convoxManifest{Services: map[string]convoxService{"web": {Image: image}}}
+	}
+	templates := map[string]string{"*": `.*:{{GIT_COMMIT}}-amd64`}
+
+	policy := newImagePolicy(templates, approvedCommit, false)
+	require.NoError(t, policy.validate(manifest("docspringcom/app:"+approvedCommit+"-amd64")))
+	require.Error(t, policy.validate(manifest("docspringcom/app:"+approvedCommit+"-amd64-backdoor")))
+
+	// A client-supplied commit is regex-escaped, so "." can't act as a wildcard.
+	dotPolicy := newImagePolicy(templates, ".", false)
+	require.Error(t, dotPolicy.validate(manifest("docspringcom/app:a-amd64")))
+	require.NoError(t, dotPolicy.validate(manifest("docspringcom/app:.-amd64")))
+}
+
+func TestImageTaggedWithCommit(t *testing.T) {
+	cases := map[string]bool{
+		"docspringcom/app:" + approvedCommit:                              true,
+		"docspringcom/app:" + approvedCommit + "-amd64":                   true,
+		"docspringcom/app:" + strings.ToUpper(approvedCommit) + "-amd64":  true,
+		"localhost:5000/app:" + approvedCommit:                            true,
+		"docspringcom/app:" + approvedCommit + "@sha256:" + otherCommit:   true,
+		"docspringcom/app:" + approvedCommit + "x":                        false,
+		"docspringcom/app:" + approvedCommit[:7] + "-amd64":               false,
+		"docspringcom/app:latest":                                         false,
+		"docspringcom/app":                                                false,
+		"localhost:5000/app":                                              false,
+		"docspringcom/" + approvedCommit + ":latest":                      false,
+		"docspringcom/app@sha256:" + approvedCommit + approvedCommit[:24]: false,
+		"docspringcom/app:prefix-" + approvedCommit:                       false,
+	}
+	for image, want := range cases {
+		require.Equalf(t, want, imageTaggedWithCommit(image, approvedCommit), "image %q", image)
+	}
+}
+
+func TestApprovedDeployCommandsFailClosedWhenEmpty(t *testing.T) {
+	h, _ := newProxyForDeployApprovalTest(t)
+	require.False(t, h.isCommandApproved("docspring", "bin/rails console"),
+		"an empty approved_deploy_commands list must not approve every command")
+}
diff --git a/internal/gateway/proxy/deploy_approval_tracking_test.go b/internal/gateway/proxy/deploy_approval_tracking_test.go
index e5a27cd5..a6410801 100644
--- a/internal/gateway/proxy/deploy_approval_tracking_test.go
+++ b/internal/gateway/proxy/deploy_approval_tracking_test.go
@@ -77,13 +77,13 @@ func TestUpdateObjectURLApprovalTracking_WithTracker(t *testing.T) {
 	approvalReq, err := database.CreateDeployApprovalRequest(
 		"Test deployment", // message
 		"test-app",        // app
-		"abc123",          // gitCommitHash
-		"main",            // gitBranch
-		"",                // prURL
-		[]byte("{}"),      // ciMetadata
-		user.ID,           // createdByUserID
-		nil,               // createdByAPITokenID
-		apiToken.ID,       // targetAPITokenID
+		"abc123def4567890abc123def4567890abc123de", // gitCommitHash
+		"main",       // gitBranch
+		"",           // prURL
+		[]byte("{}"), // ciMetadata
+		user.ID,      // createdByUserID
+		nil,          // createdByAPITokenID
+		apiToken.ID,  // targetAPITokenID
 	)
 	require.NoError(t, err)
 
@@ -116,7 +116,7 @@ func TestUpdateObjectURLApprovalTracking_WithTracker(t *testing.T) {
 	// Verify object_url was saved to database
 	updated, err := database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
@@ -164,13 +164,13 @@ func TestUpdateBuildApprovalTracking_WithTracker(t *testing.T) {
 	approvalReq, err := database.CreateDeployApprovalRequest(
 		"Test deployment", // message
 		"test-app",        // app
-		"abc123",          // gitCommitHash
-		"main",            // gitBranch
-		"",                // prURL
-		[]byte("{}"),      // ciMetadata
-		user.ID,           // createdByUserID
-		nil,               // createdByAPITokenID
-		apiToken.ID,       // targetAPITokenID
+		"abc123def4567890abc123def4567890abc123de", // gitCommitHash
+		"main",       // gitBranch
+		"",           // prURL
+		[]byte("{}"), // ciMetadata
+		user.ID,      // createdByUserID
+		nil,          // createdByAPITokenID
+		apiToken.ID,  // targetAPITokenID
 	)
 	require.NoError(t, err)
 
@@ -211,7 +211,7 @@ func TestUpdateBuildApprovalTracking_WithTracker(t *testing.T) {
 	// Verify build_id was saved
 	updated, err := database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
@@ -224,7 +224,7 @@ func TestUpdateBuildApprovalTracking_WithTracker(t *testing.T) {
 	// Verify release_id was saved
 	updated, err = database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
@@ -271,13 +271,13 @@ func TestCaptureObjectUpload_CallsUpdateObjectURLApprovalTracking(t *testing.T)
 	approvalReq, err := database.CreateDeployApprovalRequest(
 		"Test deployment", // message
 		"test-app",        // app
-		"abc123",          // gitCommitHash
-		"main",            // gitBranch
-		"",                // prURL
-		[]byte("{}"),      // ciMetadata
-		user.ID,           // createdByUserID
-		nil,               // createdByAPITokenID
-		apiToken.ID,       // targetAPITokenID
+		"abc123def4567890abc123def4567890abc123de", // gitCommitHash
+		"main",       // gitBranch
+		"",           // prURL
+		[]byte("{}"), // ciMetadata
+		user.ID,      // createdByUserID
+		nil,          // createdByAPITokenID
+		apiToken.ID,  // targetAPITokenID
 	)
 	require.NoError(t, err)
 
@@ -315,7 +315,7 @@ func TestCaptureObjectUpload_CallsUpdateObjectURLApprovalTracking(t *testing.T)
 	// Verify object_url was saved
 	updated, err := database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
@@ -351,13 +351,13 @@ func TestCaptureBuildCreation_CallsUpdateBuildApprovalTracking(t *testing.T) {
 	approvalReq, err := database.CreateDeployApprovalRequest(
 		"Test deployment", // message
 		"test-app",        // app
-		"abc123",          // gitCommitHash
-		"main",            // gitBranch
-		"",                // prURL
-		[]byte("{}"),      // ciMetadata
-		user.ID,           // createdByUserID
-		nil,               // createdByAPITokenID
-		apiToken.ID,       // targetAPITokenID
+		"abc123def4567890abc123def4567890abc123de", // gitCommitHash
+		"main",       // gitBranch
+		"",           // prURL
+		[]byte("{}"), // ciMetadata
+		user.ID,      // createdByUserID
+		nil,          // createdByAPITokenID
+		apiToken.ID,  // targetAPITokenID
 	)
 	require.NoError(t, err)
 
@@ -401,7 +401,7 @@ func TestCaptureBuildCreation_CallsUpdateBuildApprovalTracking(t *testing.T) {
 	// Verify build_id was saved but release_id is still empty
 	updated, err := database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
@@ -431,7 +431,7 @@ func TestCaptureBuildCreation_CallsUpdateBuildApprovalTracking(t *testing.T) {
 	// Verify release_id was saved
 	updated, err = database.FindDeployApprovalRequest(db.DeployApprovalLookup{
 		TokenID:       apiToken.ID,
-		GitCommitHash: "abc123",
+		GitCommitHash: "abc123def4567890abc123def4567890abc123de",
 		StatusFilter:  "approved",
 	})
 	require.NoError(t, err)
diff --git a/internal/gateway/proxy/deploy_approval_validation.go b/internal/gateway/proxy/deploy_approval_validation.go
index 0b5d49bf..90982e8b 100644
--- a/internal/gateway/proxy/deploy_approval_validation.go
+++ b/internal/gateway/proxy/deploy_approval_validation.go
@@ -1,8 +1,6 @@
 package proxy
 
 import (
-	"context"
-	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -12,156 +10,90 @@ import (
 	gtwlog "github.com/DocSpring/rack-gateway/internal/gateway/logging"
 )
 
-type buildApprovalContext struct {
-	approvalID int64
-	gitCommit  string
-	app        string
-}
-
-type buildApprovalContextKey struct{}
-
-// validateBuildManifestForAllUsers validates build manifests against configured image patterns.
-// This applies to ALL users (admin, deployer, API tokens) and enforces security policies.
-func (h *Handler) validateBuildManifestForAllUsers(r *http.Request, bodyBytes []byte) error {
-	// Parse request body (form-encoded: url=object://app/tmp/file.tgz&manifest=convox.yml&...)
-	vals, err := url.ParseQuery(string(bodyBytes))
-	if err != nil {
-		return fmt.Errorf("invalid build request body")
-	}
+const defaultManifestPath = "convox.yml"
 
-	// Get app name from path
+// validateBuildManifestForAllUsers validates build manifests against the app's configured image patterns.
+// It applies to every build that is not bound to a deploy approval (users and API tokens with direct
+// build permission). Approval-bound token builds are validated by validateTokenBuildBinding instead.
+func (h *Handler) validateBuildManifestForAllUsers(r *http.Request, vals url.Values) error {
 	app := extractAppFromPath(r.URL.Path)
-
-	// Check if manifest validation is required for this app
 	patterns, err := h.settingsService.GetServiceImagePatterns(app)
 	if err != nil {
 		return fmt.Errorf("failed to get service image patterns: %w", err)
 	}
+	if len(patterns) == 0 {
+		return nil
+	}
 
-	if len(patterns) > 0 {
-		// Manifest validation is required - extract and validate the manifest
-		objectURL := strings.TrimSpace(vals.Get("url"))
-		manifestPath := strings.TrimSpace(vals.Get("manifest"))
-		if manifestPath == "" {
-			manifestPath = "convox.yml" // Default manifest name
-		}
-
-		if objectURL == "" {
-			return fmt.Errorf("build request missing object URL")
-		}
-
-		// Get git commit for validation
-		gitSHA := strings.TrimSpace(vals.Get("git-sha"))
-		if gitSHA == "" {
-			return fmt.Errorf("git-sha is required when image pattern validation is configured")
-		}
-
-		// Validate the manifest from the tarball
-		if err := h.validateBuildManifest(r.Context(), app, objectURL, manifestPath, patterns, gitSHA); err != nil {
-			return fmt.Errorf("manifest validation failed: %w", err)
-		}
+	objectURL := strings.TrimSpace(vals.Get("url"))
+	if objectURL == "" {
+		return fmt.Errorf("build request missing object URL")
+	}
+	gitSHA := strings.TrimSpace(vals.Get("git-sha"))
+	if gitSHA == "" {
+		return fmt.Errorf("git-sha is required when image pattern validation is configured")
 	}
 
+	policy := newImagePolicy(patterns, gitSHA, false)
+	if err := h.validateBuildManifest(r.Context(), app, objectURL, manifestPathFrom(vals), policy); err != nil {
+		return fmt.Errorf("manifest validation failed: %w", err)
+	}
 	return nil
 }
 
-// validateBuildRequestForAPIToken validates build requests for API tokens with deploy approvals.
-// This is only called for API token requests and handles deploy approval tracking.
-func (h *Handler) validateBuildRequestForAPIToken(r *http.Request, bodyBytes []byte, tokenID int64) error {
-	// Parse request body (form-encoded: git-sha=abc123&url=object://app/tmp/file.tgz&manifest=convox.yml&...)
-	vals, err := url.ParseQuery(string(bodyBytes))
-	if err != nil {
-		gtwlog.Errorf("validateBuildRequestForAPIToken: failed to parse request body: %v", err)
-		return fmt.Errorf("invalid build request body")
+// validateTokenBuildBinding binds an API-token build to the deploy approval that authorized it:
+//   - the build must use the archive that was uploaded under that approval,
+//   - a git-sha, if sent, must equal the approved commit,
+//   - every service image in the uploaded manifest must be tagged with the approved commit, and
+//   - the app's configured image patterns (if any) must also match.
+//
+// The approved commit always comes from the approval record, never from the client.
+func (h *Handler) validateTokenBuildBinding(r *http.Request, vals url.Values, tracker *deployApprovalTracker) error {
+	approval := tracker.request
+	objectURL := strings.TrimSpace(vals.Get("url"))
+	if objectURL == "" || objectURL != approval.ObjectURL {
+		return fmt.Errorf("build must use the archive uploaded for deploy approval %s", approval.PublicID)
 	}
 
-	gitSHA := strings.TrimSpace(vals.Get("git-sha"))
-	if gitSHA == "" {
-		// No git-sha in request, skip git-sha validation
-		// RBAC permission check will still run separately
-		gtwlog.Infof(
-			"validateBuildRequestForAPIToken: no git-sha, skipping git-sha validation (tokenID=%d)",
-			tokenID,
-		)
-		return nil
+	commit, ok := db.NormalizeCommitSHA(approval.GitCommitHash)
+	if !ok {
+		return fmt.Errorf("deploy approval %s is not bound to a full git commit SHA", approval.PublicID)
+	}
+	if gitSHA := strings.TrimSpace(vals.Get("git-sha")); gitSHA != "" && !strings.EqualFold(gitSHA, commit) {
+		return fmt.Errorf("git-sha %s does not match the approved commit %s", gitSHA, commit)
 	}
 
-	gtwlog.Infof(
-		"validateBuildRequestForAPIToken: looking up approval for tokenID=%d git-sha=%s",
-		tokenID,
-		gitSHA,
-	)
-
-	// Check if there's an active approved deployment for this token and git commit
-	approval, err := h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
-		TokenID:       tokenID,
-		GitCommitHash: gitSHA,
-		StatusFilter:  "approved",
-	})
+	patterns, err := h.settingsService.GetServiceImagePatterns(tracker.app)
 	if err != nil {
-		if errors.Is(err, db.ErrDeployApprovalRequestNotFound) {
-			gtwlog.Warnf(
-				"validateBuildRequestForAPIToken: no approved deployment (tokenID=%d git-sha=%s)",
-				tokenID,
-				gitSHA,
-			)
-			return fmt.Errorf("deployment approval required for git commit %s", gitSHA)
-		}
-		gtwlog.Errorf("validateBuildRequestForAPIToken: database error looking up approval: %v", err)
-		return fmt.Errorf("failed to check deploy approval: %w", err)
-	}
-
-	if approval == nil {
-		gtwlog.Warnf(
-			"validateBuildRequestForAPIToken: approval lookup returned nil (tokenID=%d git-sha=%s)",
-			tokenID,
-			gitSHA,
-		)
-		return fmt.Errorf("deployment approval required for git commit %s", gitSHA)
+		return fmt.Errorf("failed to get service image patterns: %w", err)
 	}
-
-	gtwlog.Infof(
-		"validateBuildRequestForAPIToken: found approval id=%d public_id=%s for git-sha=%s",
-		approval.ID,
-		approval.PublicID,
-		gitSHA,
-	)
-
-	// Check for duplicate: only fail if object_url is set AND build already exists.
-	// The normal flow is: object upload (sets object_url) → build creation (uses same approval).
-	// If object_url is set but build hasn't been created yet, that's OK - it's the normal flow.
-	// This must happen BEFORE manifest validation to catch true duplicates even if manifest is invalid.
-	if approval.ObjectURL != "" && (approval.BuildID != "" || approval.ReleaseID != "") {
-		gtwlog.Warnf(
-			"validateBuildRequestForAPIToken: duplicate build (approval id=%d object_url=%s build_id=%s release_id=%s)",
-			approval.ID,
-			approval.ObjectURL,
-			approval.BuildID,
-			approval.ReleaseID,
+	// The commit tag alone doesn't pin the image repository (attacker/image:<sha> would pass),
+	// so approval-bound builds require patterns that name the repository.
+	if len(patterns) == 0 {
+		return fmt.Errorf(
+			"deploy approvals for app %s require service_image_patterns to pin the image repository "+
+				`(e.g. {"*": "docker.io/org/app:{{GIT_COMMIT}}-amd64"})`,
+			tracker.app,
 		)
-		return fmt.Errorf("an archive has already been uploaded for this deploy approval request")
 	}
 
-	// Get app name from path
-	app := extractAppFromPath(r.URL.Path)
-
-	// Store approval in context so we can update it after successful build
-	ctx := context.WithValue(r.Context(), buildApprovalContextKey{}, &buildApprovalContext{
-		approvalID: approval.ID,
-		gitCommit:  gitSHA,
-		app:        app,
-	})
-	*r = *r.WithContext(ctx)
-
-	gtwlog.Infof(
-		"validateBuildRequestForAPIToken: stored buildApprovalContext (approval_id=%d git-sha=%s)",
-		approval.ID,
-		gitSHA,
-	)
+	policy := newImagePolicy(patterns, commit, true)
+	if err := h.validateBuildManifest(r.Context(), tracker.app, objectURL, manifestPathFrom(vals), policy); err != nil {
+		gtwlog.Warnf("deploy approval %s: build manifest rejected: %v", approval.PublicID, err)
+		return fmt.Errorf("manifest validation failed: %w", err)
+	}
 
+	gtwlog.Infof("deploy approval %s: build bound to commit %s and object %s", approval.PublicID, commit, objectURL)
 	return nil
 }
 
+func manifestPathFrom(vals url.Values) string {
+	if manifestPath := strings.TrimSpace(vals.Get("manifest")); manifestPath != "" {
+		return manifestPath
+	}
+	return defaultManifestPath
+}
+
 // updateObjectURLApprovalTracking updates the deploy approval request with object_url
 // after a successful object upload
 func (h *Handler) updateObjectURLApprovalTracking(r *http.Request, objectURL string) error {
diff --git a/internal/gateway/proxy/env_filters.go b/internal/gateway/proxy/env_filters.go
index c080c000..ee564c58 100644
--- a/internal/gateway/proxy/env_filters.go
+++ b/internal/gateway/proxy/env_filters.go
@@ -167,6 +167,8 @@ func (h *Handler) captureProcessCreation(_ *http.Request, body []byte, tracker *
 	}
 }
 
+// isCommandApproved reports whether command is in the app's approved_deploy_commands.
+// An empty list allows no commands under a deploy approval (fail closed).
 func (h *Handler) isCommandApproved(app, command string) bool {
 	if h.settingsService == nil {
 		return false
@@ -178,10 +180,6 @@ func (h *Handler) isCommandApproved(app, command string) bool {
 		return false
 	}
 
-	if len(approvedCommands) == 0 {
-		return true
-	}
-
 	for _, approved := range approvedCommands {
 		if strings.TrimSpace(command) == strings.TrimSpace(approved) {
 			return true
diff --git a/internal/gateway/proxy/forward.go b/internal/gateway/proxy/forward.go
index 1058b5ab..44e3643a 100644
--- a/internal/gateway/proxy/forward.go
+++ b/internal/gateway/proxy/forward.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/url"
 	"regexp"
 	"strings"
 	"time"
@@ -19,6 +20,10 @@ import (
 
 const proxyLogBodyLimit = 16384
 
+// attachedRunCommand is the placeholder command `convox run` starts before exec'ing the real command
+// into the process (default --timeout). The real command is checked on the exec path.
+const attachedRunCommand = "sleep 3600"
+
 func (h *Handler) validateBuildRequest(
 	r *http.Request,
 	original string,
@@ -29,23 +34,17 @@ func (h *Handler) validateBuildRequest(
 		return nil
 	}
 
-	// For API tokens, check for duplicate object_url BEFORE manifest validation
-	// This ensures we catch duplicate uploads even if manifest validation would fail
-	if authUser.IsAPIToken && authUser.TokenID != nil {
-		if err := h.validateBuildRequestForAPIToken(r, bodyBytes, *authUser.TokenID); err != nil {
-			return err
-		}
-	}
-
-	if err := h.validateBuildManifestForAllUsers(r, bodyBytes); err != nil {
-		return err
+	vals, err := url.ParseQuery(string(bodyBytes))
+	if err != nil {
+		return fmt.Errorf("invalid build request body")
 	}
 
-	if !authUser.IsAPIToken {
-		return nil
+	if authUser.IsAPIToken {
+		if tracker := getDeployApprovalTracker(r.Context()); tracker != nil && tracker.request != nil {
+			return h.validateTokenBuildBinding(r, vals, tracker)
+		}
 	}
-
-	return nil
+	return h.validateBuildManifestForAllUsers(r, vals)
 }
 
 func (h *Handler) validateProcessCommand(
@@ -64,7 +63,7 @@ func (h *Handler) validateProcessCommand(
 
 	app := extractAppFromPath(original)
 	command := strings.TrimSpace(r.Header.Get("Command"))
-	if command != "sleep 3600" && !h.isCommandApproved(app, command) {
+	if command != attachedRunCommand && !h.isCommandApproved(app, command) {
 		return fmt.Errorf("command not approved: %s", command)
 	}
 
diff --git a/internal/gateway/proxy/manifest_policy.go b/internal/gateway/proxy/manifest_policy.go
new file mode 100644
index 00000000..1282ce75
--- /dev/null
+++ b/internal/gateway/proxy/manifest_policy.go
@@ -0,0 +1,152 @@
+package proxy
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// imagePolicy describes which service images a build manifest may reference.
+type imagePolicy struct {
+	// commit, when set, requires every service to use a pre-built image tagged with this full commit SHA.
+	commit string
+	// patterns are the app's service_image_patterns with {{GIT_COMMIT}} already substituted.
+	patterns map[string]string
+}
+
+// newImagePolicy builds a policy from the app's pattern templates. When requireCommitTag is true, every
+// service image must also be tagged with commit.
+func newImagePolicy(patternTemplates map[string]string, commit string, requireCommitTag bool) imagePolicy {
+	policy := imagePolicy{patterns: substituteCommit(patternTemplates, commit)}
+	if requireCommitTag {
+		policy.commit = commit
+	}
+	return policy
+}
+
+func (p imagePolicy) validate(manifest *convoxManifest) error {
+	if p.commit != "" {
+		if err := validateImagesTaggedWithCommit(manifest, p.commit); err != nil {
+			return err
+		}
+	}
+	if len(p.patterns) == 0 {
+		return nil
+	}
+	return validateServiceImages(manifest, p.patterns)
+}
+
+// substituteCommit replaces {{GIT_COMMIT}} in each pattern with the regex-escaped commit.
+func substituteCommit(templates map[string]string, commit string) map[string]string {
+	patterns := make(map[string]string, len(templates))
+	for service, template := range templates {
+		patterns[service] = strings.ReplaceAll(template, "{{GIT_COMMIT}}", regexp.QuoteMeta(commit))
+	}
+	return patterns
+}
+
+// validateImagesTaggedWithCommit requires every service to use a pre-built image whose tag is the
+// commit SHA, or starts with "<sha>-" (e.g. "<sha>-amd64"). Services built from source in the uploaded
+// archive cannot be tied to a commit, so they are rejected.
+func validateImagesTaggedWithCommit(manifest *convoxManifest, commit string) error {
+	if manifest == nil || len(manifest.Services) == 0 {
+		return fmt.Errorf("no services defined in manifest")
+	}
+	for _, name := range sortedServiceNames(manifest) {
+		image := strings.TrimSpace(manifest.Services[name].Image)
+		if image == "" {
+			return fmt.Errorf(
+				"service %s must use a pre-built image tagged with the approved commit %s",
+				name,
+				commit,
+			)
+		}
+		if !imageTaggedWithCommit(image, commit) {
+			return fmt.Errorf("service %s image %q is not tagged with the approved commit %s", name, image, commit)
+		}
+	}
+	return nil
+}
+
+// imageTaggedWithCommit reports whether an image reference's tag is commit or starts with commit+"-".
+func imageTaggedWithCommit(image, commit string) bool {
+	ref := image
+	if at := strings.Index(ref, "@"); at >= 0 {
+		ref = ref[:at]
+	}
+	colon := strings.LastIndex(ref, ":")
+	if colon <= strings.LastIndex(ref, "/") {
+		return false // no tag (a colon before the last slash is a registry port)
+	}
+	tag := strings.ToLower(ref[colon+1:])
+	commit = strings.ToLower(commit)
+	return tag == commit || strings.HasPrefix(tag, commit+"-")
+}
+
+// validateServiceImages validates that all service images match their required patterns.
+// Patterns are anchored, so they must match the whole image reference.
+func validateServiceImages(manifest *convoxManifest, servicePatterns map[string]string) error {
+	if manifest == nil || len(manifest.Services) == 0 {
+		return fmt.Errorf("no services defined in manifest")
+	}
+
+	compiledPatterns := make(map[string]*regexp.Regexp, len(servicePatterns))
+	for service, pattern := range servicePatterns {
+		re, err := regexp.Compile("^(?:" + pattern + ")$")
+		if err != nil {
+			return fmt.Errorf("invalid image pattern for service %s: %w", service, err)
+		}
+		compiledPatterns[service] = re
+	}
+
+	for _, serviceName := range sortedServiceNames(manifest) {
+		service := manifest.Services[serviceName]
+		if err := validateServiceImage(serviceName, service, compiledPatterns, servicePatterns); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateServiceImage(
+	serviceName string,
+	service convoxService,
+	compiled map[string]*regexp.Regexp,
+	raw map[string]string,
+) error {
+	key := serviceName
+	pattern, ok := compiled[key]
+	if !ok {
+		// Wildcard pattern applies to services without their own pattern (lowest precedence)
+		key = "*"
+		pattern, ok = compiled[key]
+	}
+	if !ok {
+		return nil
+	}
+	if service.Image == "" {
+		return fmt.Errorf(
+			"service %s must use a pre-built image (image pattern is configured for this service)",
+			serviceName,
+		)
+	}
+	if !pattern.MatchString(service.Image) {
+		return fmt.Errorf(
+			"service %s image %q does not match required pattern %q",
+			serviceName,
+			service.Image,
+			raw[key],
+		)
+	}
+	return nil
+}
+
+func sortedServiceNames(manifest *convoxManifest) []string {
+	names := make([]string, 0, len(manifest.Services))
+	for name := range manifest.Services {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}
diff --git a/internal/gateway/proxy/manifest_validation.go b/internal/gateway/proxy/manifest_validation.go
index e67c492a..2c7200f1 100644
--- a/internal/gateway/proxy/manifest_validation.go
+++ b/internal/gateway/proxy/manifest_validation.go
@@ -13,7 +13,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"regexp"
 	"strings"
 	"time"
 
@@ -38,12 +37,12 @@ type convoxService struct {
 	// Ignore all other fields
 }
 
-// validateBuildManifest fetches the tarball from the Convox API and validates the manifest
+// validateBuildManifest fetches the tarball from the Convox API and validates the manifest's
+// service images against the policy.
 func (h *Handler) validateBuildManifest(
 	ctx context.Context,
 	app, objectURL, manifestPath string,
-	servicePatterns map[string]string,
-	gitCommit string,
+	policy imagePolicy,
 ) error {
 	// Extract the object key from the URL (e.g., "object://myapp/tmp/file.tgz" -> "tmp/file.tgz")
 	// The object URL format is: object://app/key
@@ -69,14 +68,7 @@ func (h *Handler) validateBuildManifest(
 		return fmt.Errorf("failed to extract manifest: %w", err)
 	}
 
-	// Replace {{GIT_COMMIT}} in all patterns with actual commit hash
-	patterns := make(map[string]string)
-	for service, patternTemplate := range servicePatterns {
-		patterns[service] = strings.ReplaceAll(patternTemplate, "{{GIT_COMMIT}}", gitCommit)
-	}
-
-	// Validate all service images match their patterns
-	return validateServiceImages(manifest, patterns)
+	return policy.validate(manifest)
 }
 
 // fetchObject fetches an object from the Convox API
@@ -395,61 +387,3 @@ func validateTarPath(entryPath string) error {
 
 	return nil
 }
-
-// validateServiceImages validates that all service images match their required patterns
-func validateServiceImages(manifest *convoxManifest, servicePatterns map[string]string) error {
-	if manifest == nil || len(manifest.Services) == 0 {
-		return fmt.Errorf("no services defined in manifest")
-	}
-
-	// Compile all patterns
-	compiledPatterns := make(map[string]*regexp.Regexp)
-	for service, pattern := range servicePatterns {
-		re, err := regexp.Compile(pattern)
-		if err != nil {
-			return fmt.Errorf("invalid image pattern for service %s: %w", service, err)
-		}
-		compiledPatterns[service] = re
-	}
-
-	for serviceName, service := range manifest.Services {
-		// Check if this service has a pattern configured
-		pattern, hasPattern := compiledPatterns[serviceName]
-		var patternString string
-
-		if hasPattern {
-			// Use service-specific pattern
-			patternString = servicePatterns[serviceName]
-		} else if wildcardPattern, hasWildcard := compiledPatterns["*"]; hasWildcard {
-			// Use wildcard pattern as fallback (lowest precedence)
-			pattern = wildcardPattern
-			hasPattern = true
-			patternString = servicePatterns["*"]
-		}
-
-		if !hasPattern {
-			// No pattern for this service - skip validation
-			continue
-		}
-
-		// When image pattern is configured for a service, it must use a pre-built image
-		if service.Image == "" {
-			return fmt.Errorf(
-				"service %s must use a pre-built image (image pattern is configured for this service)",
-				serviceName,
-			)
-		}
-
-		// Validate image matches pattern
-		if !pattern.MatchString(service.Image) {
-			return fmt.Errorf(
-				"service %s image %q does not match required pattern %q",
-				serviceName,
-				service.Image,
-				patternString,
-			)
-		}
-	}
-
-	return nil
-}
diff --git a/internal/gateway/proxy/token_permissions.go b/internal/gateway/proxy/token_permissions.go
index 1a39aeb1..c8419701 100644
--- a/internal/gateway/proxy/token_permissions.go
+++ b/internal/gateway/proxy/token_permissions.go
@@ -221,274 +221,3 @@ func getDeployApprovalTracker(ctx context.Context) *deployApprovalTracker {
 	}
 	return nil
 }
-
-type denyFunc func() (bool, *deployApprovalTracker, error)
-
-func (h *Handler) findDeployApprovalForResource(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-	resource rbac.Resource,
-	action rbac.Action,
-) (*db.DeployApprovalRequest, error) {
-	if resolver := h.approvalResolverFor(resource, action, r.URL.Path); resolver != nil {
-		return resolver(r, deny, tokenID, app)
-	}
-	return nil, fmt.Errorf("unsupported deploy approval resource/action: %s:%s", resource, action)
-}
-
-type approvalResolver func(*http.Request, denyFunc, int64, string) (*db.DeployApprovalRequest, error)
-
-func (h *Handler) approvalResolverFor(resource rbac.Resource, action rbac.Action, path string) approvalResolver {
-	key := resource.String() + ":" + action.String()
-	table := map[string]approvalResolver{
-		rbac.ResourceObject.String() + ":" + rbac.ActionCreate.String(): func(
-			_ *http.Request,
-			_ denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForObjectCreate(tokenID, app)
-		},
-		rbac.ResourceBuild.String() + ":" + rbac.ActionCreate.String(): func(
-			_ *http.Request,
-			_ denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForBuildCreate(tokenID, app)
-		},
-		rbac.ResourceBuild.String() + ":" + rbac.ActionRead.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForBuildRead(r, deny, tokenID, app)
-		},
-		rbac.ResourceProcess.String() + ":" + rbac.ActionStart.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForProcessStart(r, deny, tokenID, app)
-		},
-		rbac.ResourceProcess.String() + ":" + rbac.ActionExec.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForProcessAction(r, deny, tokenID, app, rbac.ActionExec)
-		},
-		rbac.ResourceProcess.String() + ":" + rbac.ActionTerminate.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForProcessAction(r, deny, tokenID, app, rbac.ActionTerminate)
-		},
-		rbac.ResourceRelease.String() + ":" + rbac.ActionRead.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForReleaseRead(r, deny, tokenID, app)
-		},
-		rbac.ResourceRelease.String() + ":" + rbac.ActionPromote.String(): func(
-			r *http.Request,
-			deny denyFunc,
-			tokenID int64,
-			app string,
-		) (*db.DeployApprovalRequest, error) {
-			return h.findApprovalForReleasePromote(r, deny, tokenID, app)
-		},
-	}
-	// Special case: logs read only applies when path is build logs
-	if resource == rbac.ResourceLog && action == rbac.ActionRead && isBuildLogPath(path) {
-		return table[rbac.ResourceBuild.String()+":"+rbac.ActionRead.String()]
-	}
-	return table[key]
-}
-
-func (h *Handler) findApprovalForObjectCreate(
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	req, err := h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
-		TokenID:      tokenID,
-		App:          app,
-		StatusFilter: "approved",
-	})
-	// Fail if object_url is already set - this means an object was already uploaded for this approval.
-	// Object uploads should only happen once per approval (unlike builds, which can fail and retry).
-	if err == nil && req != nil && req.ObjectURL != "" {
-		return nil, &deployApprovalError{
-			status:  http.StatusConflict,
-			message: "an archive has already been uploaded for this deploy approval request",
-		}
-	}
-	return req, err
-}
-
-func (h *Handler) findApprovalForBuildCreate(
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	req, err := h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
-		TokenID:      tokenID,
-		App:          app,
-		StatusFilter: "approved",
-	})
-	if err == nil && req != nil {
-		if req.BuildID != "" || req.ReleaseID != "" {
-			return nil, &deployApprovalError{
-				status:  http.StatusConflict,
-				message: "a build has already been created for this deploy approval request",
-			}
-		}
-		// Check if object_url is already set AND build exists - if so, this is a duplicate upload attempt.
-		// If object_url is set but build hasn't been created yet, that's OK - it's the normal flow.
-		if req.ObjectURL != "" && (req.BuildID != "" || req.ReleaseID != "") {
-			return nil, &deployApprovalError{
-				status:  http.StatusConflict,
-				message: "an archive has already been uploaded for this deploy approval request",
-			}
-		}
-	}
-	return req, err
-}
-
-func (h *Handler) findApprovalForBuildRead(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	buildID := extractBuildIDFromPath(r.URL.Path)
-	if buildID == "" {
-		_, _, err := deny()
-		return nil, err
-	}
-	return h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
-		TokenID:      tokenID,
-		App:          app,
-		BuildID:      buildID,
-		StatusFilter: "approved",
-	})
-}
-
-func (h *Handler) findApprovalForProcessStart(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	releaseID := r.Header.Get("Release")
-	if releaseID == "" {
-		_, _, err := deny()
-		return nil, err
-	}
-	return h.database.FindDeployApprovalRequest(db.DeployApprovalLookup{
-		TokenID:      tokenID,
-		App:          app,
-		ReleaseID:    releaseID,
-		StatusFilter: "approved",
-	})
-}
-
-func (h *Handler) findApprovalForProcessAction(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-	action rbac.Action,
-) (*db.DeployApprovalRequest, error) {
-	processID := extractProcessIDFromPath(r.URL.Path)
-	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval,
-		"process %s - checking permission for tokenID=%d app=%s processID=%s",
-		action,
-		tokenID,
-		app,
-		processID,
-	)
-	if processID == "" {
-		gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - denied: empty processID", action)
-		_, _, err := deny()
-		return nil, err
-	}
-	lookup := db.DeployApprovalLookup{
-		TokenID:      tokenID,
-		App:          app,
-		ProcessID:    processID,
-		StatusFilter: "approved",
-	}
-	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - looking up deploy approval: %+v", action, lookup)
-	req, err := h.database.FindDeployApprovalRequest(lookup)
-	gtwlog.DebugTopicf(gtwlog.TopicDeployApproval, "process %s - lookup result: req=%v err=%v", action, req != nil, err)
-	return req, err
-}
-
-func (h *Handler) findApprovalForReleaseRead(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	// Use the same logic as promote - extract release ID and look up approval
-	return h.findApprovalForRelease(r, deny, tokenID, app, false)
-}
-
-func (h *Handler) findApprovalForReleasePromote(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-) (*db.DeployApprovalRequest, error) {
-	// Promote needs to check for already-deployed status
-	return h.findApprovalForRelease(r, deny, tokenID, app, true)
-}
-
-func (h *Handler) findApprovalForRelease(
-	r *http.Request,
-	deny denyFunc,
-	tokenID int64,
-	app string,
-	checkDeployed bool,
-) (*db.DeployApprovalRequest, error) {
-	releaseID := extractReleaseIDFromPath(r.URL.Path)
-	if releaseID == "" {
-		_, _, err := deny()
-		return nil, err
-	}
-
-	// For promote, we need to check if already deployed, so we can't filter by status
-	// For read, we can filter by approved status for efficiency
-	lookup := db.DeployApprovalLookup{
-		TokenID:   tokenID,
-		App:       app,
-		ReleaseID: releaseID,
-	}
-	if !checkDeployed {
-		lookup.StatusFilter = "approved"
-	}
-
-	req, err := h.database.FindDeployApprovalRequest(lookup)
-	if err == nil && req != nil {
-		if checkDeployed && req.Status == db.DeployApprovalRequestStatusDeployed {
-			return nil, &deployApprovalError{
-				status:  http.StatusConflict,
-				message: "this deploy approval request has already been deployed",
-			}
-		}
-		if req.Status != db.DeployApprovalRequestStatusApproved {
-			_, _, denyErr := deny()
-			return nil, denyErr
-		}
-	}
-	return req, err
-}
diff --git a/scripts/lib/cli-e2e/db.sh b/scripts/lib/cli-e2e/db.sh
index 3939132d..d2f1d15d 100644
--- a/scripts/lib/cli-e2e/db.sh
+++ b/scripts/lib/cli-e2e/db.sh
@@ -130,7 +130,7 @@ INSERT INTO settings (app_name, key, value, updated_at) VALUES
   (NULL, 'allow_destructive_actions', 'false'::jsonb, NOW()),
   (NULL, 'deploy_approvals_enabled', 'true'::jsonb, NOW()),
   (NULL, 'deploy_approval_window_minutes', '15'::jsonb, NOW()),
-  ('rack-gateway', 'approved_deploy_commands', '{"commands": ["echo rake db:migrate"]}'::jsonb, NOW()),
+  ('rack-gateway', 'approved_deploy_commands', '["echo rake db:migrate"]'::jsonb, NOW()),
   ('rack-gateway', 'service_image_patterns', '{"gateway": ".*:{{GIT_COMMIT}}-amd64"}'::jsonb, NOW())
 ON CONFLICT (COALESCE(app_name, ''), key) DO UPDATE
   SET value = EXCLUDED.value,
diff --git a/web/e2e/db.ts b/web/e2e/db.ts
index c1e16bcc..c49c855f 100644
--- a/web/e2e/db.ts
+++ b/web/e2e/db.ts
@@ -549,7 +549,7 @@ export async function createPendingDeployApprovalRequest(): Promise<string> {
          status
        )
        VALUES (
-         'abc123def456',
+         'abc123def4567890abc123def4567890abc123de',
          'main',
          'E2E Test Deploy Request',
          'docspring',

From 4ec0ea07a1827bb3860d19947964971aa126dadc Mon Sep 17 00:00:00 2001
From: Nathan Broadbent <git@ndbroadbent.com>
Date: Sat, 10 Oct 2026 10:19:01 +1300
Subject: [PATCH 2/3] Review fixes for deploy approval binding

Findings from the PR #21 review:

- Approval-bound builds need an image pattern for every service (its own
  or "*"). Per-service patterns used to leave unlisted services' image
  repository unpinned.
- The settings API rejects wrongly shaped values: approved_deploy_commands,
  protected_env_vars and secret_env_vars must be JSON arrays of strings and
  service_image_patterns an object of compilable patterns. A wrong shape
  used to read back as an empty list, which now allows no commands.
- The CircleCI auto-approve job re-checks the deploy approval on every
  attempt and is cancelled once it is rejected, expired or deployed, so a
  retry can't approve the hold afterwards.
- The pipeline repository check fails closed when the repository can't
  be determined.
- Docs and settings help text describe the new rules; an upgrade note
  covers the rollout order (set service_image_patterns right after
  deploying), approved command shapes and token rotation.
- Tests: pattern coverage, prefix git-sha, DocSpring's real manifest
  shape, listed and unlisted approved commands, approval re-check,
  unknown repository, empty revision, job-arg wiring and redaction.
- The E2E deploy approval seed builds its commit SHA instead of a 40-hex
  literal, and the CLI E2E image pattern pins the repository.
---
 .../docs/deployment/production-checklist.mdx  |  3 +
 .../deploy-approvals/circleci.mdx             | 22 ++++-
 .../integrations/deploy-approvals/index.mdx   |  4 +-
 .../deploy-approvals/workflow.mdx             | 17 ++--
 docs/src/content/docs/operations/upgrades.mdx | 22 +++++
 .../gateway/circleci/pipeline_verification.go |  6 +-
 .../circleci/pipeline_verification_test.go    | 10 +++
 internal/gateway/github/client_test.go        | 24 ------
 internal/gateway/github/verify_commit_test.go |  2 +
 .../gateway/handlers/deploy_approval_admin.go | 27 +++++--
 .../handlers/deploy_approval_circleci_test.go | 27 +++++++
 .../handlers/job_args_redaction_test.go       | 13 +++
 internal/gateway/handlers/settings.go         |  2 +-
 internal/gateway/handlers/settings_helpers.go | 27 ++++++-
 internal/gateway/jobs/circleci/approve.go     | 53 +++++++++++-
 .../gateway/jobs/circleci/approve_test.go     | 57 ++++++++++++-
 internal/gateway/jobs/client.go               |  2 +-
 .../proxy/deploy_approval_binding_test.go     | 47 +++++++++++
 .../proxy/deploy_approval_validation.go       |  2 +-
 internal/gateway/proxy/manifest_policy.go     | 20 +++++
 internal/gateway/settings/service_app.go      |  3 +
 internal/gateway/settings/validate.go         | 81 +++++++++++++++++++
 internal/gateway/settings/validate_test.go    | 36 +++++++++
 scripts/lib/cli-e2e/db.sh                     |  2 +-
 web/e2e/db.ts                                 |  7 +-
 web/src/pages/app-settings-page.tsx           |  2 +-
 .../service-image-patterns-card.tsx           |  8 +-
 27 files changed, 467 insertions(+), 59 deletions(-)
 create mode 100644 internal/gateway/handlers/deploy_approval_circleci_test.go
 create mode 100644 internal/gateway/settings/validate.go
 create mode 100644 internal/gateway/settings/validate_test.go

diff --git a/docs/src/content/docs/deployment/production-checklist.mdx b/docs/src/content/docs/deployment/production-checklist.mdx
index 2884adff..35715aae 100644
--- a/docs/src/content/docs/deployment/production-checklist.mdx
+++ b/docs/src/content/docs/deployment/production-checklist.mdx
@@ -186,6 +186,9 @@ Use this checklist before deploying Rack Gateway to production. Each item addres
   - CircleCI token configured
   - Approval job names match
   - GitHub integration tested
+  - `service_image_patterns` set for each app, pinning the image repository (approval-bound builds are refused without it)
+  - `approved_deploy_commands` lists the exact commands CI runs (an empty list allows none)
+  - `vcs_repo` set to `owner/repo` for CircleCI auto-approval
 
 - [ ] **CI/CD tokens created**
   - API tokens with `cicd` role
diff --git a/docs/src/content/docs/integrations/deploy-approvals/circleci.mdx b/docs/src/content/docs/integrations/deploy-approvals/circleci.mdx
index d836cb59..99d467db 100644
--- a/docs/src/content/docs/integrations/deploy-approvals/circleci.mdx
+++ b/docs/src/content/docs/integrations/deploy-approvals/circleci.mdx
@@ -141,7 +141,7 @@ jobs:
               --app myapp \
               --git-commit "$CIRCLE_SHA1" \
               --branch "$CIRCLE_BRANCH" \
-              --ci-metadata "{\"workflow_id\":\"$CIRCLE_WORKFLOW_ID\",\"pipeline_number\":<< pipeline.number >>}" \
+              --ci-metadata "{\"workflow_id\":\"$CIRCLE_WORKFLOW_ID\",\"pipeline_number\":\"<< pipeline.number >>\"}" \
               --message "Deploy $CIRCLE_BRANCH@${CIRCLE_SHA1:0:7} to production"
           environment:
             RACK_GATEWAY_API_TOKEN: $RACK_GATEWAY_API_TOKEN
@@ -241,6 +241,12 @@ sequenceDiagram
     participant Gateway as Gateway
     participant CircleCI as CircleCI API
 
+    Gateway->>Gateway: Deploy approval still approved and unexpired?
+    Gateway->>CircleCI: GET /workflow/{workflow_id}
+    CircleCI-->>Gateway: pipeline_id
+    Gateway->>CircleCI: GET /pipeline/{pipeline_id}
+    CircleCI-->>Gateway: vcs.revision, repository URLs
+    Gateway->>Gateway: Revision = approved commit? Repository = vcs_repo? Not a fork?
     Gateway->>CircleCI: GET /workflow/{workflow_id}/job
     CircleCI-->>Gateway: List of jobs
     Gateway->>Gateway: Find job matching approval_job_name
@@ -248,12 +254,17 @@ sequenceDiagram
     CircleCI-->>Gateway: 202 Accepted
 ```
 
+The `ci_metadata` comes from the CI job that requested the approval, so the gateway doesn't trust it on its
+own: the hold job is only approved when the workflow's pipeline is building the approved commit of the app's
+repository, and the job is re-checked against the deploy approval on every attempt (retries can run later,
+after a rejection or expiry).
+
 ### What Gateway Needs
 
 | Source | Data |
 |--------|------|
-| CI metadata | `workflow_id` |
-| App settings | `circleci_approval_job_name` |
+| CI metadata | `workflow_id` (a CircleCI workflow UUID), `pipeline_number` (string) |
+| App settings | `circleci_approval_job_name`, `vcs_repo` (`owner/repo`) |
 | Gateway config | `CIRCLECI_TOKEN` |
 
 ## Pipeline URL Display
@@ -345,6 +356,8 @@ curl -H "Circle-Token: YOUR_TOKEN" https://circleci.com/api/v2/me
 - [ ] `ci_metadata` includes `workflow_id`
 - [ ] `CIRCLECI_TOKEN` has correct permissions
 - [ ] App `ci_provider` is set to `circleci`
+- [ ] App `vcs_repo` is set to the repository CircleCI builds (`owner/repo`)
+- [ ] The workflow was building the approved commit (not a later re-run of another commit)
 
 **Check gateway logs:**
 ```bash
@@ -358,6 +371,9 @@ convox logs --app rack-gateway | grep -i circleci
 | `approval job 'xxx' not found in workflow` | Job name mismatch |
 | `403 Forbidden` | Token lacks permissions or expired |
 | `workflow not found` | Invalid workflow_id in metadata |
+| `invalid CircleCI workflow_id` | `workflow_id` is not a UUID (the job is cancelled) |
+| `CircleCI pipeline does not match the deploy approval` | The pipeline builds another commit or repository, is a fork, or its repository can't be determined (the job is cancelled; approve the hold manually after checking) |
+| `deploy approval is no longer active` | The approval was rejected, expired or deployed before the job ran (the job is cancelled) |
 
 ### API Token Permissions
 
diff --git a/docs/src/content/docs/integrations/deploy-approvals/index.mdx b/docs/src/content/docs/integrations/deploy-approvals/index.mdx
index b5f8ac0d..4ab56099 100644
--- a/docs/src/content/docs/integrations/deploy-approvals/index.mdx
+++ b/docs/src/content/docs/integrations/deploy-approvals/index.mdx
@@ -207,7 +207,7 @@ rack-gateway deploy-approval request \
   --app myapp \
   --git-commit "$CIRCLE_SHA1" \
   --branch "$CIRCLE_BRANCH" \
-  --ci-metadata '{"workflow_id":"abc-123","pipeline_number":"42"}' \
+  --ci-metadata "{\"workflow_id\":\"$CIRCLE_WORKFLOW_ID\",\"pipeline_number\":\"42\"}" \
   --message "Deploy to production"
 ```
 
@@ -230,7 +230,7 @@ rack-gateway deploy-approval list --status pending
 
 ```bash
 rack-gateway deploy-approval request \
-  --git-commit abc123f \
+  --git-commit "$CIRCLE_SHA1" \
   --message "Deploy" \
   --wait \
   --timeout 20m
diff --git a/docs/src/content/docs/integrations/deploy-approvals/workflow.mdx b/docs/src/content/docs/integrations/deploy-approvals/workflow.mdx
index e345beba..dfbcc33f 100644
--- a/docs/src/content/docs/integrations/deploy-approvals/workflow.mdx
+++ b/docs/src/content/docs/integrations/deploy-approvals/workflow.mdx
@@ -59,7 +59,7 @@ rack-gateway deploy-approval request \
   --app myapp \
   --git-commit "$CIRCLE_SHA1" \
   --branch "$CIRCLE_BRANCH" \
-  --ci-metadata '{"workflow_id":"$CIRCLE_WORKFLOW_ID","pipeline_number":<< pipeline.number >>}' \
+  --ci-metadata "{\"workflow_id\":\"$CIRCLE_WORKFLOW_ID\",\"pipeline_number\":\"<< pipeline.number >>\"}" \
   --message "Deploy $CIRCLE_BRANCH to production"
 ```
 
@@ -222,18 +222,25 @@ graph TD
 
 ### Image Tag Pattern
 
-Default pattern: `.*:{{GIT_COMMIT}}`
+There is no default: an approval-bound build is refused until the app's `service_image_patterns` setting
+gives every service a pattern (its own, or `"*"`), and each pattern should name the image repository:
+
+```json
+{"*": "docker\\.io/myorg/app:{{GIT_COMMIT}}-amd64"}
+```
 
 ```yaml
 # convox.yml
 services:
   web:
-    image: myorg/app:abc123f-amd64  # Must match approved commit
+    image: docker.io/myorg/app:0123456789abcdef0123456789abcdef01234567-amd64
   worker:
-    image: myorg/app:abc123f-amd64
+    image: docker.io/myorg/app:0123456789abcdef0123456789abcdef01234567-amd64
 ```
 
-The gateway replaces `{{GIT_COMMIT}}` with the approved commit hash and validates all service images match.
+Every service must use a pre-built image tagged with the full approved commit (`<sha>` or `<sha>-<suffix>`).
+The gateway replaces `{{GIT_COMMIT}}` with the approved commit (regex-escaped) and requires each image to match
+its pattern exactly. The commit always comes from the approval, never from the client.
 
 ### What Gets Tracked
 
diff --git a/docs/src/content/docs/operations/upgrades.mdx b/docs/src/content/docs/operations/upgrades.mdx
index f2b99383..2c4f1386 100644
--- a/docs/src/content/docs/operations/upgrades.mdx
+++ b/docs/src/content/docs/operations/upgrades.mdx
@@ -297,6 +297,28 @@ aws rds restore-db-instance-from-db-snapshot \
 # Deploy previous version
 ```
 
+## Release Notes That Need Action
+
+### Deploy approvals bound to commits (v0.1.3)
+
+Approval-bound CI builds now have to use pre-built images tagged with the approved commit, from a repository
+pinned by `service_image_patterns`. Builds are refused until the patterns are set, so plan the rollout:
+
+1. **Set `service_image_patterns` right after the new version is live, not before.** Earlier versions require
+   the build's `git-sha` once patterns are configured, and a CI build from a directory that isn't a git
+   checkout sends none, so setting them first breaks deploys on the old version. Avoid running CI deploys
+   until the patterns are set: a build refused in that window has already used up its approval's archive
+   upload, so the request has to be rejected (or left to expire) and requested again.
+2. **Check `approved_deploy_commands` is a JSON array of strings** for every app. An empty list (or a value of
+   any other shape) now allows no commands, where it used to allow every command. The settings API refuses
+   other shapes from this version on.
+3. **Check `vcs_repo`** is `owner/repo` for apps using CircleCI auto-approval. Hold jobs are only approved when
+   the workflow's pipeline builds the approved commit of that repository.
+4. CircleCI approval jobs queued by the previous version are cancelled rather than run; approve those holds in
+   CircleCI by hand.
+5. Earlier versions stored `CIRCLECI_TOKEN` and `GITHUB_TOKEN` in background job arguments. Once the old
+   version is fully drained, remove them from `river_job.args` and rotate both tokens.
+
 ## Version Compatibility
 
 ### API Compatibility
diff --git a/internal/gateway/circleci/pipeline_verification.go b/internal/gateway/circleci/pipeline_verification.go
index ddc1c601..9b11e4b0 100644
--- a/internal/gateway/circleci/pipeline_verification.go
+++ b/internal/gateway/circleci/pipeline_verification.go
@@ -82,7 +82,11 @@ func verifyPipeline(pipeline *pipelineDetails, expect ApprovalExpectation) error
 	if actual == "" {
 		actual = repoFromProjectSlug(pipeline.ProjectSlug)
 	}
-	if actual != "" && !strings.EqualFold(actual, expectedRepo) {
+	if actual == "" {
+		return fmt.Errorf("%w: cannot determine the pipeline's repository (expected %s)",
+			ErrPipelineMismatch, expectedRepo)
+	}
+	if !strings.EqualFold(actual, expectedRepo) {
 		return fmt.Errorf("%w: pipeline repository %s, expected %s", ErrPipelineMismatch, actual, expectedRepo)
 	}
 	return nil
diff --git a/internal/gateway/circleci/pipeline_verification_test.go b/internal/gateway/circleci/pipeline_verification_test.go
index 64f0ba61..06b185c6 100644
--- a/internal/gateway/circleci/pipeline_verification_test.go
+++ b/internal/gateway/circleci/pipeline_verification_test.go
@@ -80,6 +80,9 @@ func TestApproveJobRefusesMismatchedPipelines(t *testing.T) {
 			revision: approvedSHA, targetRepo: docspringRepo, originRepo: "https://github.com/attacker/docspring",
 		},
 		"different project slug": {revision: approvedSHA, slug: "gh/attacker/other"},
+		// A GitHub App project slug doesn't name the repository; with no repository URL either, it
+		// can't be checked, so it isn't approved.
+		"unknown repository": {revision: approvedSHA, slug: "circleci/org-id/project-id"},
 	}
 	for name, pipeline := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -107,3 +110,10 @@ func TestParseMetadataRequiresUUIDWorkflowID(t *testing.T) {
 	})
 	require.ErrorIs(t, err, ErrInvalidWorkflowID)
 }
+
+// Jobs queued before the approved revision was stored have no revision to check and are never approved.
+func TestVerifyPipelineRequiresApprovedRevision(t *testing.T) {
+	pipeline := &pipelineDetails{}
+	pipeline.VCS.Revision = approvedSHA
+	require.ErrorIs(t, verifyPipeline(pipeline, ApprovalExpectation{}), ErrPipelineMismatch)
+}
diff --git a/internal/gateway/github/client_test.go b/internal/gateway/github/client_test.go
index befec5ca..ec7dfc91 100644
--- a/internal/gateway/github/client_test.go
+++ b/internal/gateway/github/client_test.go
@@ -2,7 +2,6 @@ package github
 
 import (
 	"encoding/json"
-	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -238,29 +237,6 @@ func TestDoRequestServerError(t *testing.T) {
 	}
 }
 
-// TestVerifyCommitOnBranchIntegration tests verifyCommitOnBranch using doRequest
-func TestVerifyCommitOnBranchIntegration(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Verify it's a compare request
-		if !strings.Contains(r.URL.Path, "/compare/") {
-			t.Errorf("Expected compare API path, got: %s", r.URL.Path)
-		}
-
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"status": "behind"}`))
-	}))
-	defer server.Close()
-
-	client := NewClient("test-token")
-
-	// Override URL for testing by calling doRequest directly with test server
-	url := fmt.Sprintf("%s/repos/owner/repo/compare/abc123...def456", server.URL)
-	err := client.doRequest("GET", url, nil, http.StatusOK, "commit abc123 not found or not on branch main", nil)
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-}
-
 // TestGetBranchIntegration tests getBranch using doRequest
 func TestGetBranchIntegration(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
diff --git a/internal/gateway/github/verify_commit_test.go b/internal/gateway/github/verify_commit_test.go
index 83a0807c..b238bd2c 100644
--- a/internal/gateway/github/verify_commit_test.go
+++ b/internal/gateway/github/verify_commit_test.go
@@ -91,4 +91,6 @@ func TestBranchNamesArePathEscaped(t *testing.T) {
 		VerifyCommitOptions{Mode: settings.VerifyGitCommitModeBranch},
 	)
 	require.Error(t, err, "path traversal in a branch name must not reach another endpoint")
+	require.Contains(t, *paths, "/repos/DocSpring/docspring/branches/..%2F..%2Fother%2Frepo",
+		"the branch name must stay inside the branches path")
 }
diff --git a/internal/gateway/handlers/deploy_approval_admin.go b/internal/gateway/handlers/deploy_approval_admin.go
index ea3e7862..88dfc61f 100644
--- a/internal/gateway/handlers/deploy_approval_admin.go
+++ b/internal/gateway/handlers/deploy_approval_admin.go
@@ -320,14 +320,8 @@ func (h *AdminHandler) enqueueCircleCIApprovalJob(c *gin.Context, record *db.Dep
 	}
 
 	if h.jobsClient != nil {
-		_, err := h.jobsClient.Insert(c.Request.Context(), jobcircleci.ApproveJobArgs{
-			WorkflowID:              circleciMetadata.WorkflowID,
-			PipelineNumber:          circleciMetadata.PipelineNumber,
-			ApprovalJobName:         circleciMetadata.ApprovalJobName,
-			DeployApprovalRequestID: record.ID,
-			ExpectedRevision:        record.GitCommitHash,
-			ExpectedRepo:            vcsRepo,
-		}, &river.InsertOpts{
+		args := circleCIApprovalJobArgs(record, circleciMetadata, vcsRepo)
+		_, err := h.jobsClient.Insert(c.Request.Context(), args, &river.InsertOpts{
 			Queue:       jobs.QueueIntegrations,
 			MaxAttempts: jobs.MaxAttemptsNotification,
 		})
@@ -337,6 +331,23 @@ func (h *AdminHandler) enqueueCircleCIApprovalJob(c *gin.Context, record *db.Dep
 	}
 }
 
+// circleCIApprovalJobArgs binds the CircleCI approval job to the deploy approval: the worker re-checks the
+// approval and only approves a pipeline building its commit from the app's repository.
+func circleCIApprovalJobArgs(
+	record *db.DeployApprovalRequest,
+	metadata *circleci.ApprovalMetadata,
+	vcsRepo string,
+) jobcircleci.ApproveJobArgs {
+	return jobcircleci.ApproveJobArgs{
+		WorkflowID:              metadata.WorkflowID,
+		PipelineNumber:          metadata.PipelineNumber,
+		ApprovalJobName:         metadata.ApprovalJobName,
+		DeployApprovalRequestID: record.ID,
+		ExpectedRevision:        record.GitCommitHash,
+		ExpectedRepo:            vcsRepo,
+	}
+}
+
 // GetDeployApprovalRequestAuditLogs godoc
 // @Summary Get audit logs for a deploy approval request
 // @Description Returns audit logs for a specific deploy approval request
diff --git a/internal/gateway/handlers/deploy_approval_circleci_test.go b/internal/gateway/handlers/deploy_approval_circleci_test.go
new file mode 100644
index 00000000..090f7ca1
--- /dev/null
+++ b/internal/gateway/handlers/deploy_approval_circleci_test.go
@@ -0,0 +1,27 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/DocSpring/rack-gateway/internal/gateway/circleci"
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
+)
+
+// The queued CircleCI approval carries what the worker checks: the deploy approval to re-check, and the
+// commit and repository the pipeline must be building.
+func TestCircleCIApprovalJobArgsBindTheApproval(t *testing.T) {
+	record := &db.DeployApprovalRequest{ID: 42, GitCommitHash: "0123456789abcdef0123456789abcdef01234567"}
+	metadata := &circleci.ApprovalMetadata{
+		WorkflowID: "11111111-2222-3333-4444-555555555555", PipelineNumber: "100", ApprovalJobName: "approve_deploy_us",
+	}
+
+	args := circleCIApprovalJobArgs(record, metadata, "DocSpring/docspring")
+
+	require.Equal(t, int64(42), args.DeployApprovalRequestID)
+	require.Equal(t, record.GitCommitHash, args.ExpectedRevision)
+	require.Equal(t, "DocSpring/docspring", args.ExpectedRepo)
+	require.Equal(t, metadata.WorkflowID, args.WorkflowID)
+	require.Equal(t, "approve_deploy_us", args.ApprovalJobName)
+}
diff --git a/internal/gateway/handlers/job_args_redaction_test.go b/internal/gateway/handlers/job_args_redaction_test.go
index f1ddd2b6..772dd0de 100644
--- a/internal/gateway/handlers/job_args_redaction_test.go
+++ b/internal/gateway/handlers/job_args_redaction_test.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/riverqueue/river/rivertype"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -40,3 +41,15 @@ func TestRedactJobArgsWithholdsUnparseableArgs(t *testing.T) {
 	assert.Nil(t, redactJobArgs(json.RawMessage(`not json "token":"x"`)))
 	assert.Nil(t, redactJobArgs(nil))
 }
+
+// Every jobs API response goes through toJobResponse, so job args never reach the client unredacted.
+func TestJobResponseRedactsArgs(t *testing.T) {
+	job := &rivertype.JobRow{
+		ID: 1, Kind: "circleci:approve_job", State: rivertype.JobStateAvailable,
+		EncodedArgs: []byte(`{"circleci_token":"leaked","workflow_id":"w"}`),
+	}
+	encoded, err := json.Marshal(toJobResponse(job).Args)
+	require.NoError(t, err)
+	assert.NotContains(t, string(encoded), "leaked")
+	assert.Contains(t, string(encoded), `"workflow_id":"w"`)
+}
diff --git a/internal/gateway/handlers/settings.go b/internal/gateway/handlers/settings.go
index 6a354c98..6146a25c 100644
--- a/internal/gateway/handlers/settings.go
+++ b/internal/gateway/handlers/settings.go
@@ -312,7 +312,7 @@ func (h *SettingsHandler) updateAppSettingValue(c *gin.Context, key string) {
 
 	ops := &appSettingsOps{service: h.settingsService}
 	if err := ops.setSetting(appName, key, value, uid); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("failed to save setting: %s", key)})
+		respondSettingSaveError(c, key, err)
 		return
 	}
 
diff --git a/internal/gateway/handlers/settings_helpers.go b/internal/gateway/handlers/settings_helpers.go
index f60d719b..9f237ab4 100644
--- a/internal/gateway/handlers/settings_helpers.go
+++ b/internal/gateway/handlers/settings_helpers.go
@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 
@@ -141,10 +142,16 @@ func (h *SettingsHandler) updateSettings(c *gin.Context, ops settingsOperations,
 		}
 	}
 
+	// Check every value before saving any, so a bad value doesn't leave a partial update
+	if err := validateSettingValues(updates); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
 	// Save all settings
 	for key, value := range updates {
 		if err := ops.setSetting(appName, key, value, uid); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("failed to save setting: %s", key)})
+			respondSettingSaveError(c, key, err)
 			return
 		}
 	}
@@ -207,3 +214,21 @@ func (_ *SettingsHandler) getSingleSettingResponse(c *gin.Context, ops settingsO
 
 	c.JSON(http.StatusOK, result)
 }
+
+// respondSettingSaveError answers 400 for a value with the wrong shape and 500 for anything else.
+func respondSettingSaveError(c *gin.Context, key string, err error) {
+	if errors.Is(err, settings.ErrInvalidSettingValue) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusInternalServerError, gin.H{"error": fmt.Sprintf("failed to save setting: %s", key)})
+}
+
+func validateSettingValues(updates map[string]interface{}) error {
+	for key, value := range updates {
+		if err := settings.ValidateAppSettingValue(key, value); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/internal/gateway/jobs/circleci/approve.go b/internal/gateway/jobs/circleci/approve.go
index 0a4ae499..3bc28ed7 100644
--- a/internal/gateway/jobs/circleci/approve.go
+++ b/internal/gateway/jobs/circleci/approve.go
@@ -5,10 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/riverqueue/river"
 
 	"github.com/DocSpring/rack-gateway/internal/gateway/circleci"
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
 )
 
 // ApproveJobArgs contains parameters for CircleCI job approval.
@@ -27,23 +29,41 @@ type ApproveJobArgs struct {
 // Kind returns the unique identifier for this job type
 func (ApproveJobArgs) Kind() string { return "circleci:approve_job" }
 
+// ApprovalStore loads deploy approval requests.
+type ApprovalStore interface {
+	GetDeployApprovalRequest(id int64) (*db.DeployApprovalRequest, error)
+}
+
+// errApprovalNotActive means the deploy approval was rejected, expired or used since the job was queued.
+var errApprovalNotActive = errors.New("deploy approval is no longer active")
+
 // ApproveJobWorker approves CircleCI jobs
 type ApproveJobWorker struct {
 	river.WorkerDefaults[ApproveJobArgs]
-	token string
+	approvals ApprovalStore
+	token     string
+	now       func() time.Time
 }
 
 // NewApproveJobWorker creates a new CircleCI approve job worker using the given API token.
-func NewApproveJobWorker(token string) *ApproveJobWorker {
-	return &ApproveJobWorker{token: token}
+func NewApproveJobWorker(approvals ApprovalStore, token string) *ApproveJobWorker {
+	return &ApproveJobWorker{approvals: approvals, token: token, now: time.Now}
 }
 
-// Work approves the CircleCI job after verifying its pipeline matches the deploy approval.
+// Work approves the CircleCI job after checking the deploy approval is still approved and the
+// workflow's pipeline matches it. Retries can run hours after the job was queued, so the approval is
+// re-checked on every attempt.
 func (w *ApproveJobWorker) Work(_ context.Context, job *river.Job[ApproveJobArgs]) error {
 	if strings.TrimSpace(w.token) == "" {
 		return river.JobCancel(fmt.Errorf("CircleCI token not configured"))
 	}
 	args := job.Args
+	if err := w.ensureApprovalActive(args.DeployApprovalRequestID); err != nil {
+		if errors.Is(err, errApprovalNotActive) {
+			return river.JobCancel(err)
+		}
+		return err
+	}
 	client := circleci.NewClient(w.token)
 	expect := circleci.ApprovalExpectation{Revision: args.ExpectedRevision, Repo: args.ExpectedRepo}
 
@@ -59,6 +79,31 @@ func (w *ApproveJobWorker) Work(_ context.Context, job *river.Job[ApproveJobArgs
 	return nil
 }
 
+// ensureApprovalActive returns an errApprovalNotActive error unless the deploy approval is approved and
+// unexpired. Other errors (e.g. the database being unavailable) are returned as-is so the job retries.
+func (w *ApproveJobWorker) ensureApprovalActive(id int64) error {
+	if w.approvals == nil {
+		return fmt.Errorf("deploy approval store not configured")
+	}
+	if id == 0 {
+		return fmt.Errorf("%w: job has no deploy approval request", errApprovalNotActive)
+	}
+	approval, err := w.approvals.GetDeployApprovalRequest(id)
+	if approval == nil && (err == nil || errors.Is(err, db.ErrDeployApprovalRequestNotFound)) {
+		return fmt.Errorf("%w: deploy approval request %d not found", errApprovalNotActive, id)
+	}
+	if err != nil {
+		return fmt.Errorf("failed to load deploy approval request %d: %w", id, err)
+	}
+	if approval.Status != db.DeployApprovalRequestStatusApproved {
+		return fmt.Errorf("%w: deploy approval %s is %s", errApprovalNotActive, approval.PublicID, approval.Status)
+	}
+	if approval.ApprovalExpiresAt != nil && w.now().After(*approval.ApprovalExpiresAt) {
+		return fmt.Errorf("%w: deploy approval %s has expired", errApprovalNotActive, approval.PublicID)
+	}
+	return nil
+}
+
 // isNonRetryableError checks if the error indicates a permanent failure that shouldn't be retried
 func isNonRetryableError(err error) bool {
 	if err == nil {
diff --git a/internal/gateway/jobs/circleci/approve_test.go b/internal/gateway/jobs/circleci/approve_test.go
index b08b4c8d..c5d5ab1a 100644
--- a/internal/gateway/jobs/circleci/approve_test.go
+++ b/internal/gateway/jobs/circleci/approve_test.go
@@ -1,14 +1,20 @@
 package circleci
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"testing"
+	"time"
 
+	"github.com/riverqueue/river"
+	"github.com/riverqueue/river/rivertype"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/DocSpring/rack-gateway/internal/gateway/circleci"
+	"github.com/DocSpring/rack-gateway/internal/gateway/db"
 )
 
 // Test ApproveJobArgs.Kind
@@ -32,7 +38,7 @@ func TestApproveJobArgs_DoNotContainToken(t *testing.T) {
 
 // Test NewApproveJobWorker
 func TestNewApproveJobWorker(t *testing.T) {
-	worker := NewApproveJobWorker("token")
+	worker := NewApproveJobWorker(nil, "token")
 	require.NotNil(t, worker)
 }
 
@@ -41,3 +47,52 @@ func TestPipelineMismatchIsNonRetryable(t *testing.T) {
 	assert.True(t, isNonRetryableError(fmt.Errorf("wrapped: %w", circleci.ErrInvalidWorkflowID)))
 	assert.False(t, isNonRetryableError(fmt.Errorf("CircleCI API error (502): bad gateway")))
 }
+
+type fakeApprovals map[int64]*db.DeployApprovalRequest
+
+func (f fakeApprovals) GetDeployApprovalRequest(id int64) (*db.DeployApprovalRequest, error) {
+	if approval, ok := f[id]; ok {
+		return approval, nil
+	}
+	return nil, db.ErrDeployApprovalRequestNotFound
+}
+
+// A retry can run hours after the job was queued; if the deploy approval was rejected or has expired by
+// then, the job is canceled before CircleCI is called.
+func TestApproveJobCancelledWhenApprovalNoLongerActive(t *testing.T) {
+	past := time.Now().Add(-time.Minute)
+	future := time.Now().Add(time.Hour)
+	approvals := fakeApprovals{
+		1: {PublicID: "rejected", Status: db.DeployApprovalRequestStatusRejected, ApprovalExpiresAt: &future},
+		2: {PublicID: "expired", Status: db.DeployApprovalRequestStatusApproved, ApprovalExpiresAt: &past},
+		3: {PublicID: "deployed", Status: db.DeployApprovalRequestStatusDeployed, ApprovalExpiresAt: &future},
+	}
+	worker := NewApproveJobWorker(approvals, "token")
+
+	for _, id := range []int64{1, 2, 3, 404, 0} {
+		job := &river.Job[ApproveJobArgs]{
+			JobRow: &rivertype.JobRow{},
+			Args:   ApproveJobArgs{WorkflowID: "not-a-uuid", DeployApprovalRequestID: id},
+		}
+		err := worker.Work(context.Background(), job)
+		var cancel *river.JobCancelError
+		require.Truef(t, errors.As(err, &cancel), "approval %d: want cancel, got %v", id, err)
+		require.ErrorIsf(t, err, errApprovalNotActive, "approval %d", id)
+	}
+}
+
+// Database errors are retried rather than canceling the job.
+func TestApproveJobRetriesWhenApprovalLookupFails(t *testing.T) {
+	worker := NewApproveJobWorker(failingApprovals{}, "token")
+	job := &river.Job[ApproveJobArgs]{JobRow: &rivertype.JobRow{}, Args: ApproveJobArgs{DeployApprovalRequestID: 1}}
+	err := worker.Work(context.Background(), job)
+	require.Error(t, err)
+	var cancel *river.JobCancelError
+	require.False(t, errors.As(err, &cancel))
+}
+
+type failingApprovals struct{}
+
+func (failingApprovals) GetDeployApprovalRequest(int64) (*db.DeployApprovalRequest, error) {
+	return nil, errors.New("connection refused")
+}
diff --git a/internal/gateway/jobs/client.go b/internal/gateway/jobs/client.go
index dec5b0ee..85e8014f 100644
--- a/internal/gateway/jobs/client.go
+++ b/internal/gateway/jobs/client.go
@@ -91,7 +91,7 @@ func NewClient(pool *pgxpool.Pool, deps *Dependencies, auditAnchorConfig *AuditA
 	river.AddWorker(workers, jobslack.NewDeployApprovalWorker(deps.Database, deps.SlackNotifier))
 
 	// CI/GitHub workers
-	river.AddWorker(workers, jobcircleci.NewApproveJobWorker(deps.CircleCIToken))
+	river.AddWorker(workers, jobcircleci.NewApproveJobWorker(deps.Database, deps.CircleCIToken))
 	river.AddWorker(workers, jobgithub.NewPostPRCommentWorker(deps.GitHubToken))
 
 	// Setup periodic jobs
diff --git a/internal/gateway/proxy/deploy_approval_binding_test.go b/internal/gateway/proxy/deploy_approval_binding_test.go
index 8bda31f0..2fb592ea 100644
--- a/internal/gateway/proxy/deploy_approval_binding_test.go
+++ b/internal/gateway/proxy/deploy_approval_binding_test.go
@@ -240,3 +240,50 @@ func TestApprovedDeployCommandsFailClosedWhenEmpty(t *testing.T) {
 	require.False(t, h.isCommandApproved("docspring", "bin/rails console"),
 		"an empty approved_deploy_commands list must not approve every command")
 }
+
+// Per-service patterns pin only the services they name; any other service must be covered too, or its
+// image could come from any repository that has an image tagged with the approved commit.
+func TestTokenBuildRequiresAPatternForEveryService(t *testing.T) {
+	f := newBindingFixture(t)
+	f.setImagePatterns(t, map[string]string{"svca": `docker\.io/docspringcom/app:{{GIT_COMMIT}}`})
+
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit)
+	require.NoError(t, f.build(t, "url="+approvedObjectURL))
+
+	f.manifest = imageManifest("docker.io/docspringcom/app:"+approvedCommit, "ghcr.io/attacker/payload:"+approvedCommit)
+	require.ErrorContains(t, f.build(t, "url="+approvedObjectURL), "service svcb has no image pattern")
+}
+
+// A prefix of the approved commit is not the approved commit.
+func TestTokenBuildRejectsPrefixGitSHA(t *testing.T) {
+	f := newBindingFixture(t)
+	f.manifest = imageManifest("docker.io/docspringcom/app:" + approvedCommit)
+	err := f.build(t, "url="+approvedObjectURL+"&git-sha="+approvedCommit[:7])
+	require.ErrorContains(t, err, "does not match the approved commit")
+}
+
+// DocSpring's real manifest shape after CI rewrites the image tags, with the production pattern.
+func TestTokenBuildAcceptsDocSpringManifest(t *testing.T) {
+	f := newBindingFixture(t)
+	f.setImagePatterns(t, map[string]string{"*": `docker\.io/docspringcom/app:{{GIT_COMMIT}}-amd64`})
+	image := "docker.io/docspringcom/app:" + approvedCommit + "-amd64"
+	f.manifest = "appSettings:\n  awsLogs: true\n" +
+		"services:\n" +
+		"  web:\n    image: " + image + "\n    port: 3000\n    environment:\n      - DATABASE_URL\n" +
+		"  worker:\n    image: " + image + "\n    command: bundle exec sidekiq\n" +
+		"  worker-gj:\n    image: " + image + "\n" +
+		"  command:\n    image: " + image + "\n" +
+		"timers:\n  cleanup:\n    schedule: \"0 3 * * ?\"\n    command: bin/rails cleanup\n    service: command\n"
+	require.NoError(t, f.build(t, "url="+approvedObjectURL))
+}
+
+func TestApprovedDeployCommandsAllowOnlyListedCommands(t *testing.T) {
+	h, database := newProxyForDeployApprovalTest(t)
+	app := "docspring"
+	require.NoError(t, database.UpsertSetting(
+		&app, "approved_deploy_commands", []string{"bin/pre_release_checks migrate"}, nil,
+	))
+	require.True(t, h.isCommandApproved("docspring", "bin/pre_release_checks migrate"))
+	require.False(t, h.isCommandApproved("docspring", "bin/rails console"))
+	require.False(t, h.isCommandApproved("docspring", "bin/pre_release_checks migrate; bin/rails console"))
+}
diff --git a/internal/gateway/proxy/deploy_approval_validation.go b/internal/gateway/proxy/deploy_approval_validation.go
index 90982e8b..40b723a2 100644
--- a/internal/gateway/proxy/deploy_approval_validation.go
+++ b/internal/gateway/proxy/deploy_approval_validation.go
@@ -72,7 +72,7 @@ func (h *Handler) validateTokenBuildBinding(r *http.Request, vals url.Values, tr
 	if len(patterns) == 0 {
 		return fmt.Errorf(
 			"deploy approvals for app %s require service_image_patterns to pin the image repository "+
-				`(e.g. {"*": "docker.io/org/app:{{GIT_COMMIT}}-amd64"})`,
+				`(e.g. {"*": "docker\\.io/org/app:{{GIT_COMMIT}}-amd64"})`,
 			tracker.app,
 		)
 	}
diff --git a/internal/gateway/proxy/manifest_policy.go b/internal/gateway/proxy/manifest_policy.go
index 1282ce75..b4184e72 100644
--- a/internal/gateway/proxy/manifest_policy.go
+++ b/internal/gateway/proxy/manifest_policy.go
@@ -30,6 +30,10 @@ func (p imagePolicy) validate(manifest *convoxManifest) error {
 		if err := validateImagesTaggedWithCommit(manifest, p.commit); err != nil {
 			return err
 		}
+		// The commit tag doesn't pin the repository, so every service needs a pattern that does.
+		if err := requirePatternForEveryService(manifest, p.patterns); err != nil {
+			return err
+		}
 	}
 	if len(p.patterns) == 0 {
 		return nil
@@ -37,6 +41,22 @@ func (p imagePolicy) validate(manifest *convoxManifest) error {
 	return validateServiceImages(manifest, p.patterns)
 }
 
+// requirePatternForEveryService fails when a service has neither its own pattern nor a "*" pattern.
+func requirePatternForEveryService(manifest *convoxManifest, patterns map[string]string) error {
+	if _, ok := patterns["*"]; ok {
+		return nil
+	}
+	for _, name := range sortedServiceNames(manifest) {
+		if _, ok := patterns[name]; !ok {
+			return fmt.Errorf(
+				`service %s has no image pattern; add one for it or a "*" pattern to service_image_patterns`,
+				name,
+			)
+		}
+	}
+	return nil
+}
+
 // substituteCommit replaces {{GIT_COMMIT}} in each pattern with the regex-escaped commit.
 func substituteCommit(templates map[string]string, commit string) map[string]string {
 	patterns := make(map[string]string, len(templates))
diff --git a/internal/gateway/settings/service_app.go b/internal/gateway/settings/service_app.go
index 8403295c..e0f2c22a 100644
--- a/internal/gateway/settings/service_app.go
+++ b/internal/gateway/settings/service_app.go
@@ -71,6 +71,9 @@ func (s *Service) GetAllAppSettings(appName string) (map[string]*Setting, error)
 
 // SetAppSetting saves an app-specific setting to the database.
 func (s *Service) SetAppSetting(appName, key string, value interface{}, updatedByUserID *int64) error {
+	if err := ValidateAppSettingValue(key, value); err != nil {
+		return err
+	}
 	return s.db.UpsertSetting(&appName, key, value, updatedByUserID)
 }
 
diff --git a/internal/gateway/settings/validate.go b/internal/gateway/settings/validate.go
new file mode 100644
index 00000000..65889285
--- /dev/null
+++ b/internal/gateway/settings/validate.go
@@ -0,0 +1,81 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+)
+
+// ErrInvalidSettingValue means a setting value has the wrong shape for its key.
+var ErrInvalidSettingValue = errors.New("invalid setting value")
+
+// stringListKeys are app settings stored as a JSON array of strings. A value of any other shape would
+// read back as an empty list, and an empty approved_deploy_commands list allows no commands.
+var stringListKeys = map[string]bool{
+	KeyApprovedDeployCommands: true,
+	KeyProtectedEnvVars:       true,
+	KeySecretEnvVars:          true,
+}
+
+// ValidateAppSettingValue checks the shape of an app setting value before it is saved.
+func ValidateAppSettingValue(key string, value interface{}) error {
+	switch {
+	case stringListKeys[key]:
+		return validateStringList(key, value)
+	case key == KeyServiceImagePatterns:
+		return validateImagePatterns(value)
+	default:
+		return nil
+	}
+}
+
+func validateStringList(key string, value interface{}) error {
+	switch v := value.(type) {
+	case []string:
+		return nil
+	case []interface{}:
+		for _, item := range v {
+			if _, ok := item.(string); !ok {
+				return fmt.Errorf("%w: %s must be a list of strings", ErrInvalidSettingValue, key)
+			}
+		}
+		return nil
+	default:
+		return fmt.Errorf("%w: %s must be a JSON array of strings", ErrInvalidSettingValue, key)
+	}
+}
+
+// validateImagePatterns requires an object of service name to pattern, where each pattern compiles once
+// {{GIT_COMMIT}} is substituted.
+func validateImagePatterns(value interface{}) error {
+	patterns := map[string]string{}
+	switch v := value.(type) {
+	case map[string]string:
+		patterns = v
+	case map[string]interface{}:
+		for service, raw := range v {
+			pattern, ok := raw.(string)
+			if !ok {
+				return fmt.Errorf("%w: image pattern for %s must be a string", ErrInvalidSettingValue, service)
+			}
+			patterns[service] = pattern
+		}
+	default:
+		return fmt.Errorf("%w: %s must be an object of service name to pattern", ErrInvalidSettingValue,
+			KeyServiceImagePatterns)
+	}
+	services := make([]string, 0, len(patterns))
+	for service := range patterns {
+		services = append(services, service)
+	}
+	sort.Strings(services)
+	for _, service := range services {
+		pattern := strings.ReplaceAll(patterns[service], "{{GIT_COMMIT}}", "0")
+		if _, err := regexp.Compile("^(?:" + pattern + ")$"); err != nil {
+			return fmt.Errorf("%w: image pattern for %s: %v", ErrInvalidSettingValue, service, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/gateway/settings/validate_test.go b/internal/gateway/settings/validate_test.go
new file mode 100644
index 00000000..5eeb5b10
--- /dev/null
+++ b/internal/gateway/settings/validate_test.go
@@ -0,0 +1,36 @@
+package settings
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateAppSettingValue(t *testing.T) {
+	valid := map[string]interface{}{
+		KeyApprovedDeployCommands: []interface{}{"bin/pre_release_checks migrate"},
+		KeyProtectedEnvVars:       []string{"DATABASE_URL"},
+		KeySecretEnvVars:          []interface{}{},
+		KeyServiceImagePatterns:   map[string]interface{}{"*": `docker\.io/docspringcom/app:{{GIT_COMMIT}}-amd64`},
+		"some_other_key":          map[string]interface{}{"anything": 1},
+	}
+	for key, value := range valid {
+		require.NoErrorf(t, ValidateAppSettingValue(key, value), "key %s", key)
+	}
+
+	invalid := map[string]interface{}{
+		// The shape the CLI E2E seed used to store: it read back as an empty list.
+		KeyApprovedDeployCommands: map[string]interface{}{"commands": []interface{}{"echo rake db:migrate"}},
+		KeyProtectedEnvVars:       "DATABASE_URL",
+		KeySecretEnvVars:          []interface{}{"A", 1},
+		KeyServiceImagePatterns:   []interface{}{"docker.io/app:{{GIT_COMMIT}}"},
+	}
+	for key, value := range invalid {
+		require.ErrorIsf(t, ValidateAppSettingValue(key, value), ErrInvalidSettingValue, "key %s", key)
+	}
+
+	require.ErrorIs(t, ValidateAppSettingValue(KeyServiceImagePatterns, map[string]interface{}{"web": "app:("}),
+		ErrInvalidSettingValue)
+	require.ErrorIs(t, ValidateAppSettingValue(KeyServiceImagePatterns, map[string]interface{}{"web": 1}),
+		ErrInvalidSettingValue)
+}
diff --git a/scripts/lib/cli-e2e/db.sh b/scripts/lib/cli-e2e/db.sh
index d2f1d15d..221d8c1d 100644
--- a/scripts/lib/cli-e2e/db.sh
+++ b/scripts/lib/cli-e2e/db.sh
@@ -131,7 +131,7 @@ INSERT INTO settings (app_name, key, value, updated_at) VALUES
   (NULL, 'deploy_approvals_enabled', 'true'::jsonb, NOW()),
   (NULL, 'deploy_approval_window_minutes', '15'::jsonb, NOW()),
   ('rack-gateway', 'approved_deploy_commands', '["echo rake db:migrate"]'::jsonb, NOW()),
-  ('rack-gateway', 'service_image_patterns', '{"gateway": ".*:{{GIT_COMMIT}}-amd64"}'::jsonb, NOW())
+  ('rack-gateway', 'service_image_patterns', '{"gateway": "docspringcom/rack-gateway:{{GIT_COMMIT}}-amd64"}'::jsonb, NOW())
 ON CONFLICT (COALESCE(app_name, ''), key) DO UPDATE
   SET value = EXCLUDED.value,
       updated_at = NOW();
diff --git a/web/e2e/db.ts b/web/e2e/db.ts
index c49c855f..6c205dd8 100644
--- a/web/e2e/db.ts
+++ b/web/e2e/db.ts
@@ -507,6 +507,9 @@ export async function setupBothMfaMethodsForUser(email: string) {
   })
 }
 
+// Deploy approvals are bound to full 40-character commit SHAs.
+const E2E_DEPLOY_COMMIT_SHA = 'abc123de'.repeat(5)
+
 export async function createPendingDeployApprovalRequest(): Promise<string> {
   return await withDbClient(async (client) => {
     // Get admin user ID for the token
@@ -549,7 +552,7 @@ export async function createPendingDeployApprovalRequest(): Promise<string> {
          status
        )
        VALUES (
-         'abc123def4567890abc123def4567890abc123de',
+         $2,
          'main',
          'E2E Test Deploy Request',
          'docspring',
@@ -557,7 +560,7 @@ export async function createPendingDeployApprovalRequest(): Promise<string> {
          'pending'
        )
        RETURNING public_id;`,
-      [tokenId]
+      [tokenId, E2E_DEPLOY_COMMIT_SHA]
     )
 
     return result.rows[0].public_id
diff --git a/web/src/pages/app-settings-page.tsx b/web/src/pages/app-settings-page.tsx
index 2a3739e9..94269275 100644
--- a/web/src/pages/app-settings-page.tsx
+++ b/web/src/pages/app-settings-page.tsx
@@ -76,7 +76,7 @@ export function AppSettingsPage() {
         <div className="grid grid-cols-2 gap-12">
           <StringArrayCard
             app={app}
-            description="Commands that a CI/CD token can run during an approved deploy request."
+            description="The exact commands a CI/CD token can run during an approved deploy request. An empty list allows none."
             disabled={!isAdmin}
             pathSegment="approved-deploy-commands"
             placeholder="e.g. bundle exec rake db:migrate"
diff --git a/web/src/pages/app-settings/service-image-patterns-card.tsx b/web/src/pages/app-settings/service-image-patterns-card.tsx
index d4d6761f..003a24eb 100644
--- a/web/src/pages/app-settings/service-image-patterns-card.tsx
+++ b/web/src/pages/app-settings/service-image-patterns-card.tsx
@@ -97,8 +97,10 @@ export function ServiceImagePatternsCard({
       </CardHeader>
       <CardContent className="space-y-4 pb-6">
         <p className="text-muted-foreground text-sm">
-          Per-service regex patterns for validating Docker images in convox.yml. Validates build
-          commands to ensure only images matching the pattern are allowed.
+          Per-service regex patterns for the Docker images in convox.yml, matched against the whole
+          image reference. Required for builds made under a deploy approval: every service needs a
+          pattern (its own or &quot;*&quot;) that names the image repository. {'{{GIT_COMMIT}}'} is
+          replaced with the approved commit.
         </p>
         <div>
           <Label htmlFor="service-image-patterns">JSON object (service name → regex)</Label>
@@ -108,7 +110,7 @@ export function ServiceImagePatternsCard({
               disabled={disabled}
               id="service-image-patterns"
               onChange={(event) => setValue(event.target.value)}
-              placeholder='{"web": "^ghcr.io/myorg/myapp:{{GIT_COMMIT}}$", "worker": "^.*$"}'
+              placeholder='{"*": "docker\\.io/myorg/app:{{GIT_COMMIT}}-amd64"}'
               value={displayValue}
             />
             <SourceIndicator setting={setting} />

From 779a6796b6d3013461a0c177f683eb171c80327c Mon Sep 17 00:00:00 2001
From: Nathan Broadbent <git@ndbroadbent.com>
Date: Sat, 10 Oct 2026 10:57:03 +1300
Subject: [PATCH 3/3] E2E db helper: plain strings for SQL without
 interpolation

---
 web/e2e/db.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/e2e/db.ts b/web/e2e/db.ts
index 6c205dd8..9d551dd8 100644
--- a/web/e2e/db.ts
+++ b/web/e2e/db.ts
@@ -514,7 +514,7 @@ export async function createPendingDeployApprovalRequest(): Promise<string> {
   return await withDbClient(async (client) => {
     // Get admin user ID for the token
     const adminResult = await client.query(
-      `SELECT id FROM users WHERE email = 'admin@example.com' LIMIT 1;`
+      "SELECT id FROM users WHERE email = 'admin@example.com' LIMIT 1;"
     )
     if (adminResult.rows.length === 0) {
       throw new Error('Admin user not found')
@@ -536,7 +536,7 @@ export async function createPendingDeployApprovalRequest(): Promise<string> {
     } else {
       // Token already exists, fetch it
       const existing = await client.query(
-        `SELECT id FROM api_tokens WHERE name = 'E2E Test Token' LIMIT 1;`
+        "SELECT id FROM api_tokens WHERE name = 'E2E Test Token' LIMIT 1;"
       )
       tokenId = existing.rows[0].id
     }