diff --git a/.github/actions/setup-project/action.yml b/.github/actions/setup-project/action.yml
index ac16ab41e..c095bd595 100644
--- a/.github/actions/setup-project/action.yml
+++ b/.github/actions/setup-project/action.yml
@@ -9,10 +9,10 @@ runs:
         sudo apt-get update \
         && sudo apt-get install -y --no-install-recommends \
         libcurl4-openssl-dev
-    - name: Set up Python 3.12
+    - name: Set up Python 3.12.3
       uses: actions/setup-python@v4
       with:
-        python-version: "3.12"
+        python-version: "3.12.3"
     - name: Install poetry
       shell: bash
       run: pip install --upgrade poetry
diff --git a/poetry.lock b/poetry.lock
index fd83e39ce..29222296c 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -2823,13 +2823,13 @@ ptyprocess = ">=0.5"
 
 [[package]]
 name = "phonenumbers"
-version = "8.13.38"
+version = "8.13.39"
 description = "Python version of Google's common library for parsing, formatting, storing and validating international phone numbers."
 optional = false
 python-versions = "*"
 files = [
-    {file = "phonenumbers-8.13.38-py2.py3-none-any.whl", hash = "sha256:d22aa747fb591ef2a18afec13cab5a0e294ab20fce5a1560e4949e459e70eeef"},
-    {file = "phonenumbers-8.13.38.tar.gz", hash = "sha256:2822c74ee9334e9d8ad792fc352cc8d21004307349b6b1bb61da12937fa2eaba"},
+    {file = "phonenumbers-8.13.39-py2.py3-none-any.whl", hash = "sha256:3ad2d086fa71e7eef409001b9195ac54bebb0c6e3e752209b558ca192c9229a0"},
+    {file = "phonenumbers-8.13.39.tar.gz", hash = "sha256:db7ca4970d206b2056231105300753b1a5b229f43416f8c2b3010e63fbb68d77"},
 ]
 
 [[package]]
@@ -4748,4 +4748,4 @@ multidict = ">=4.0"
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.12.2"
-content-hash = "460acc2fefc9038bbbf2290afb1c657ea43018dd8abb626370044988d49744d6"
+content-hash = "122fe6459adad8b8105d12739e4db159ae39fc32e969d02c7c24436ed3fb85b1"
diff --git a/pyproject.toml b/pyproject.toml
index f9cf4ff6e..ff5d6a959 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -55,7 +55,7 @@ geojson = "^3.1.0"
 govuk-bank-holidays = "^0.14"
 numpy = "^1.26.4"
 ordered-set = "^4.1.0"
-phonenumbers = "^8.13.38"
+phonenumbers = "^8.13.39"
 python-json-logger = "^2.0.7"
 pytz = "^2024.1"
 regex = "^2024.5.15"
diff --git a/runtime.txt b/runtime.txt
index 64f28603a..4ddc7cd66 100644
--- a/runtime.txt
+++ b/runtime.txt
@@ -1 +1 @@
-python-3.12.x
+python-3.12.3
diff --git a/terraform/demo/main.tf b/terraform/demo/main.tf
index e252ddf6d..a791082b3 100644
--- a/terraform/demo/main.tf
+++ b/terraform/demo/main.tf
@@ -3,27 +3,33 @@ locals {
   cf_space_name    = "notify-demo"
   env              = "demo"
   app_name         = "notify-api"
-  recursive_delete = false
+  recursive_delete = false # deprecated, still used in shared modules
+}
+
+
+resource "null_resource" "prevent_destroy" {
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 module "database" {
-  source = "github.com/18f/terraform-cloudgov//database?ref=v0.7.1"
+  source = "github.com/GSA-TTS/terraform-cloudgov//database?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  name             = "${local.app_name}-rds-${local.env}"
-  recursive_delete = local.recursive_delete
-  rds_plan_name    = "micro-psql"
+  cf_org_name   = local.cf_org_name
+  cf_space_name = local.cf_space_name
+  name          = "${local.app_name}-rds-${local.env}"
+  rds_plan_name = "micro-psql"
 }
 
 module "redis" { # default v6.2; delete after v7.0 resource is bound
-  source = "github.com/18f/terraform-cloudgov//redis?ref=v0.7.1"
+  source = "github.com/GSA-TTS/terraform-cloudgov//redis?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  name             = "${local.app_name}-redis-${local.env}"
-  recursive_delete = local.recursive_delete
-  redis_plan_name  = "redis-dev"
+  cf_org_name     = local.cf_org_name
+  cf_space_name   = local.cf_space_name
+  name            = "${local.app_name}-redis-${local.env}"
+  redis_plan_name = "redis-dev"
 }
 
 module "redis-v70" {
@@ -41,12 +47,11 @@ module "redis-v70" {
 }
 
 module "csv_upload_bucket" {
-  source = "github.com/18f/terraform-cloudgov//s3?ref=v0.7.1"
+  source = "github.com/GSA-TTS/terraform-cloudgov//s3?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  recursive_delete = local.recursive_delete
-  name             = "${local.app_name}-csv-upload-bucket-${local.env}"
+  cf_org_name   = local.cf_org_name
+  cf_space_name = local.cf_space_name
+  name          = "${local.app_name}-csv-upload-bucket-${local.env}"
 }
 
 module "egress-space" {
@@ -66,7 +71,6 @@ module "ses_email" {
   cf_org_name         = local.cf_org_name
   cf_space_name       = local.cf_space_name
   name                = "${local.app_name}-ses-${local.env}"
-  recursive_delete    = local.recursive_delete
   aws_region          = "us-west-2"
   email_domain        = "notify.sandbox.10x.gsa.gov"
   email_receipt_error = "notify-support@gsa.gov"
@@ -78,7 +82,6 @@ module "sns_sms" {
   cf_org_name         = local.cf_org_name
   cf_space_name       = local.cf_space_name
   name                = "${local.app_name}-sns-${local.env}"
-  recursive_delete    = local.recursive_delete
   aws_region          = "us-east-1"
   monthly_spend_limit = 25
 }
diff --git a/terraform/sandbox/main.tf b/terraform/sandbox/main.tf
index b0b6381bd..2a9fa87aa 100644
--- a/terraform/sandbox/main.tf
+++ b/terraform/sandbox/main.tf
@@ -16,19 +16,19 @@ resource "null_resource" "prevent_destroy" {
 module "database" {
   source = "github.com/GSA-TTS/terraform-cloudgov//database?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  name             = "${local.app_name}-rds-${local.env}"
-  rds_plan_name    = "micro-psql"
+  cf_org_name   = local.cf_org_name
+  cf_space_name = local.cf_space_name
+  name          = "${local.app_name}-rds-${local.env}"
+  rds_plan_name = "micro-psql"
 }
 
 module "redis" { # default v6.2; delete after v7.0 resource is bound
   source = "github.com/GSA-TTS/terraform-cloudgov//redis?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  name             = "${local.app_name}-redis-${local.env}"
-  redis_plan_name  = "redis-dev"
+  cf_org_name     = local.cf_org_name
+  cf_space_name   = local.cf_space_name
+  name            = "${local.app_name}-redis-${local.env}"
+  redis_plan_name = "redis-dev"
 }
 
 module "redis-v70" {
@@ -48,9 +48,9 @@ module "redis-v70" {
 module "csv_upload_bucket" {
   source = "github.com/GSA-TTS/terraform-cloudgov//s3?ref=v1.0.0"
 
-  cf_org_name      = local.cf_org_name
-  cf_space_name    = local.cf_space_name
-  name             = "${local.app_name}-csv-upload-bucket-${local.env}"
+  cf_org_name   = local.cf_org_name
+  cf_space_name = local.cf_space_name
+  name          = "${local.app_name}-csv-upload-bucket-${local.env}"
 }
 
 module "egress-space" {