diff --git a/.github/actions/zipx-sbt-setup/action.yml b/.github/actions/zipx-sbt-setup/action.yml
index 3b1c1a7..6708935 100644
--- a/.github/actions/zipx-sbt-setup/action.yml
+++ b/.github/actions/zipx-sbt-setup/action.yml
@@ -70,7 +70,7 @@ runs:
           epoch="$release"
         elif tag=$(git describe --tags --abbrev=0 --match "$tag_match" 2>/dev/null); then
           release="${tag#v}"
-          epoch="${release}-ci"
+          epoch="${release}-SNAPSHOT"
         else
           echo "::warning title=zipx cache epoch::No tags matching '$tag_match' found; using epoch 0.0.0."
           release="0.0.0"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 17d0252..3730729 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,8 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
+    env:
+      COURSIER_TTL: "0s"
     outputs:
       run: ${{ steps.check.outputs.run }}
     steps:
@@ -58,6 +60,8 @@ jobs:
     needs:
       - verify-gate
     if: needs.verify-gate.result == 'success' && needs.verify-gate.outputs.run == 'false'
+    env:
+      COURSIER_TTL: "0s"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -81,6 +85,8 @@ jobs:
     needs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
+    env:
+      COURSIER_TTL: "0s"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -96,6 +102,8 @@ jobs:
           sbt-disk-cache: "false"
           cache-mode: save
           cache-epoch: ""
+      - name: Pinned snapshots
+        run: echo "::warning title=zipx snapshots::pinned snapshots (rocks.earlyeffect:sbt-zipx:0.17.0-SNAPSHOT)"
       - name: test
         run: |
           if [ "$ZIPX_VERIFY_CLEAN_FULL" = "true" ]; then
@@ -111,6 +119,8 @@ jobs:
     needs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
+    env:
+      COURSIER_TTL: "0s"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -141,6 +151,8 @@ jobs:
     needs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
+    env:
+      COURSIER_TTL: "0s"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -171,6 +183,8 @@ jobs:
     needs:
       - verify-gate
     if: "!cancelled() && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' && ((needs.verify-gate.result != 'success') || (needs.verify-gate.outputs.run == 'true'))"
+    env:
+      COURSIER_TTL: "0s"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -200,6 +214,7 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     env:
+      COURSIER_TTL: "0s"
       PGP_KEY_HEX: ${{ secrets.PGP_KEY_HEX }}
       PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
       SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
diff --git a/project/ZipxVersions.scala b/project/ZipxVersions.scala
index eb63297..0e81916 100644
--- a/project/ZipxVersions.scala
+++ b/project/ZipxVersions.scala
@@ -6,7 +6,7 @@ import zipx.*
   * sbt-pgp is not a row: zipx already brings it in.
   */
 object MyVersions extends ZipxVersions:
-  val sbt: SbtVersion = SbtVersion("2.1.0-M2")
+  val sbt: SbtVersion = SbtVersion("2.1.0-M3")
   val scala: ScalaVersion = ScalaVersion("3.9.0")
 
   /** Oldest supported 3.x for the dotc shim. Not a catalog row. */
diff --git a/project/build.properties b/project/build.properties
index 3604e52..3e1457f 100644
--- a/project/build.properties
+++ b/project/build.properties
@@ -1,2 +1,2 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-sbt.version=2.1.0-M2
+sbt.version=2.1.0-M3
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 20e570f..fded3de 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,5 +1,7 @@
 // Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
-addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.13.0")
+resolvers += "central-snapshots" at "https://central.sonatype.com/repository/maven-snapshots/"
+forceUpdatePeriod := Some(scala.concurrent.duration.Duration.Zero)
+addSbtPlugin("rocks.earlyeffect" % "sbt-zipx" % "0.17.0-SNAPSHOT")
 addSbtPlugin("com.eed3si9n" % "sbt-assembly" % "2.5.0")
 addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.6.2")
 addSbtPlugin("com.github.sbt" % "sbt-dynver" % "5.1.1")
diff --git a/project/zipx-ci.env b/project/zipx-ci.env
index 2bf592c..01719ab 100644
--- a/project/zipx-ci.env
+++ b/project/zipx-ci.env
@@ -1,4 +1,3 @@
 # Generated by zipx. Do not edit. Run 'sbt zipxWorkflowGenerate' to regenerate.
 ZIPX_JAVA_VERSION=25
 ZIPX_RUNNER_OS=ubuntu-latest
-ZIPX_CLI_VERSION=0.13.0