- Before triggering a deployment, ensure that no deployment is already in progress. - Address the secret stale-read risk in syncSecrets, where preserved keys are fetched without a version lock.