diff --git a/docker-compose.yaml b/docker-compose.yaml
index d003f8e..9fb5fb7 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -30,7 +30,8 @@
 services:
   openvpn:
     # Pulls the published multi-arch image from GHCR - the five-minute path.
-    # Set CULVERT_IMAGE to pin a tag (e.g. ...culvert:v2.1.3) or point at a
+    # Risk accepted: the :latest default serves that path only. A deployment
+    # sets CULVERT_IMAGE to a digest pin (...culvert:vX.Y.Z@sha256:...) or a
     # private mirror. To build locally instead, uncomment the build: block
     # below and run `docker compose up --build`.
     image: ${CULVERT_IMAGE:-ghcr.io/hyperi-io/culvert:latest}
diff --git a/profiles/edge-fleet.yaml b/profiles/edge-fleet.yaml
index a333ead..898e106 100644
--- a/profiles/edge-fleet.yaml
+++ b/profiles/edge-fleet.yaml
@@ -36,11 +36,9 @@ routing_control_enabled: true
 # reaches them). Isolation stays ON.
 client_isolation: true
 
-# Sharing is left at the shipped default deliberately. This preset runs 2-8
-# replicas, and duplicate-cn is enforced per OpenVPN process, so opting out
-# would give per-pod exclusivity while reading as a fleet-wide guarantee. Each
-# appliance already holds its own certificate; a cloned one is caught by the
-# connection log and revoked with revoke-client, not by duplicate-cn.
+# Sharing is left at the shipped default deliberately. Each appliance holds
+# its own certificate, and a cloned one is caught by the connection log and
+# revoked with revoke-client, not by duplicate-cn.
 
 # Outbound allow-list: appliances may only INITIATE to the receiver
 # network. Set this to your receiver's service CIDR.
@@ -59,9 +57,8 @@ downstream_admin_cidrs: "10.10.0.0/16"
 # allowed_destinations + downstream_admin_cidrs.
 push_routes: "10.20.0.0/16,10.10.0.0/16"
 
-# K8s behind a connection-based LB: log to stdout for the cluster log
-# pipeline. The LB must be connection-sticky (a single UDP/TCP flow
-# stays pinned to one culvert pod); see docs/use-case-edge-fleet.md.
+# Log to stdout for the cluster log pipeline; see
+# docs/use-case-kubernetes.md for the single-replica chart install.
 log_mode: stdout
 
 # External PKI is typical here (fleet CA in OpenBao / a mounted secret).
diff --git a/pyproject.toml b/pyproject.toml
index 4606a62..d4e5e78 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,9 +30,11 @@ secrets-aws = ["scalo[secrets-aws]"]
 secrets-gcp = ["scalo[secrets-gcp]"]
 secrets-azure = ["scalo[secrets-azure]"]
 otel = ["scalo[opentelemetry]"]
-# Bounded, like the runtime deps. An unpinned dev dependency is not a loose
-# constraint but an invisible one: nothing proposes an update, and the version
-# moves silently on the next lock refresh.
+
+# A group, not an extra: uv syncs it by default, so ty and pytest under
+# `uv run` resolve the test imports. Bounded, like the runtime deps -- an
+# unpinned dev dependency moves silently on the next lock refresh.
+[dependency-groups]
 dev = [
     "ruff>=0.16.1,<0.17",
     "pytest>=9.1,<10",
diff --git a/tests/run-unit.sh b/tests/run-unit.sh
index 17aa6d7..b6775b6 100755
--- a/tests/run-unit.sh
+++ b/tests/run-unit.sh
@@ -40,9 +40,9 @@ main() {
     cd "${SCRIPT_DIR}/.."
 
     if [[ "${1:-}" == "--verbose" ]] || [[ "${1:-}" == "-v" ]]; then
-        uv run --frozen --extra dev pytest tests/unit -v
+        uv run --frozen --group dev pytest tests/unit -v
     else
-        uv run --frozen --extra dev pytest tests/unit
+        uv run --frozen --group dev pytest tests/unit
     fi
 }
 
diff --git a/uv.lock b/uv.lock
index 2575fdc..ebef704 100644
--- a/uv.lock
+++ b/uv.lock
@@ -588,13 +588,6 @@ dependencies = [
 ]
 
 [package.optional-dependencies]
-dev = [
-    { name = "cryptography" },
-    { name = "pytest" },
-    { name = "pytest-cov" },
-    { name = "ruff" },
-    { name = "scalo", extra = ["deployment"] },
-]
 otel = [
     { name = "scalo", extra = ["opentelemetry"] },
 ]
@@ -611,14 +604,18 @@ secrets-vault = [
     { name = "scalo", extra = ["secrets-vault"] },
 ]
 
+[package.dev-dependencies]
+dev = [
+    { name = "cryptography" },
+    { name = "pytest" },
+    { name = "pytest-cov" },
+    { name = "ruff" },
+    { name = "scalo", extra = ["deployment"] },
+]
+
 [package.metadata]
 requires-dist = [
-    { name = "cryptography", marker = "extra == 'dev'", specifier = ">=50,<51" },
-    { name = "pytest", marker = "extra == 'dev'", specifier = ">=9.1,<10" },
-    { name = "pytest-cov", marker = "extra == 'dev'", specifier = ">=7.1,<8" },
     { name = "pyyaml", specifier = ">=6,<7" },
-    { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.16.1,<0.17" },
-    { name = "scalo", extras = ["deployment"], marker = "extra == 'dev'", specifier = ">=2.31.3,<3" },
     { name = "scalo", extras = ["metrics", "secrets-vault", "secrets-aws"], specifier = ">=2.31.3,<3" },
     { name = "scalo", extras = ["opentelemetry"], marker = "extra == 'otel'" },
     { name = "scalo", extras = ["secrets-aws"], marker = "extra == 'secrets-aws'" },
@@ -626,7 +623,16 @@ requires-dist = [
     { name = "scalo", extras = ["secrets-gcp"], marker = "extra == 'secrets-gcp'" },
     { name = "scalo", extras = ["secrets-vault"], marker = "extra == 'secrets-vault'" },
 ]
-provides-extras = ["secrets-vault", "secrets-aws", "secrets-gcp", "secrets-azure", "otel", "dev"]
+provides-extras = ["secrets-vault", "secrets-aws", "secrets-gcp", "secrets-azure", "otel"]
+
+[package.metadata.requires-dev]
+dev = [
+    { name = "cryptography", specifier = ">=50,<51" },
+    { name = "pytest", specifier = ">=9.1,<10" },
+    { name = "pytest-cov", specifier = ">=7.1,<8" },
+    { name = "ruff", specifier = ">=0.16.1,<0.17" },
+    { name = "scalo", extras = ["deployment"], specifier = ">=2.31.3,<3" },
+]
 
 [[package]]
 name = "detect-secrets"