diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 77f5479d..74c99cb5 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -3,10 +3,10 @@
   "service": "devcontainer",
   "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
   "features": {
-    "ghcr.io/devcontainers/features/aws-cli:1.1.1": {
+    "ghcr.io/devcontainers/features/aws-cli:1.1.2": {
       // https://github.com/devcontainers/features/blob/main/src/aws-cli/devcontainer-feature.json
       // view latest version https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst
-      "version": "2.27.14"
+      "version": "2.32.6"
     },
     "ghcr.io/devcontainers/features/python:1.7.1": {
       // https://github.com/devcontainers/features/blob/main/src/python/devcontainer-feature.json
@@ -19,6 +19,7 @@
     "vscode": {
       // Add the IDs of extensions you want installed when the container is created.
       "extensions": [
+        "-AmazonWebServices.aws-toolkit-vscode", // the AWS CLI feature installs this automatically, but it's causing problems in VS Code
         // basic tooling
         // "eamodio.gitlens@15.5.1",
         "coderabbit.coderabbit-vscode@0.16.0",
@@ -61,5 +62,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 876c1d76 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 5878af82 # spellchecker:disable-line
 }
diff --git a/.devcontainer/windows-host-helper.sh b/.devcontainer/windows-host-helper.sh
index b3d1d876..f760b3bf 100644
--- a/.devcontainer/windows-host-helper.sh
+++ b/.devcontainer/windows-host-helper.sh
@@ -7,7 +7,7 @@
 
 # If you're still having issues, make sure in Windows Developer Settings that you enabled Developer Mode, and also that you set your git config to have `core.autocrlf=false` and `core.symlinks=true` globally
 
-set -euo pipefail  # Exit immediately on error
+set -e  # Exit immediately on error
 
 if [ -z "$BASH_VERSION" ]; then
   echo "Error: This script must be run with bash (e.g., 'bash windows-host-helper.sh')." >&2
@@ -27,38 +27,29 @@ repoName=$(basename "$gitUrl" .git)
 
 echo "Repo name extracted as '$repoName'"
 
-# Remove any existing subfolder with the repository name and recreate it
-rm -rf "./$repoName" || true # sometimes deleting the .venv folder fails
-rm -rf "./$repoName/*.md" # for some reason, sometimes md files are left behind
+sudo rm -rf "./$repoName" || true
+sudo rm -rf "./$repoName/*.md"
 mkdir -p "./$repoName"
 
 # Create a temporary directory for cloning
 tmpdir=$(mktemp -d)
 
-# Clone the repository into a subfolder inside the temporary directory.
-# This creates "$tmpdir/$repoName" with the repository's contents.
+# Clone the repository into a subfolder inside the temporary directory
 git clone "$gitUrl" "$tmpdir/$repoName"
 
-
-SRC="$(realpath "$tmpdir/$repoName")"
-DST="$(realpath "./$repoName")"
-
-# 1) Recreate directory tree under $DST
-while IFS= read -r -d '' dir; do
-  rel="${dir#$SRC/}"             # strip leading $SRC/ → e.g. "sub/dir"
-  mkdir -p "$DST/$rel"
-done < <(find "$SRC" -type d -print0)
-
-# 2) Move all files into that mirror
-while IFS= read -r -d '' file; do
-  rel="${file#$SRC/}"            # e.g. "sub/dir/file.txt"
-  # ensure parent exists (though step 1 already did)
-  mkdir -p "$(dirname "$DST/$rel")"
-  mv "$file" "$DST/$rel"
-done < <(find "$SRC" -type f -print0)
-
-# 3) Clean up now‑empty dirs and the tmp clone
-find "$SRC" -depth -type d -empty -delete
+# Use rsync to merge all contents (including hidden files) from cloned repo to target
+# -a: archive mode (preserves permissions, timestamps, etc.)
+# -v: verbose
+# --exclude: skip volume mount directories that should not be overwritten
+echo "Syncing repository contents..."
+rsync -av \
+    --exclude='node_modules' \
+    --exclude='.pnpm-store' \
+    --exclude='.venv' \
+    "$tmpdir/$repoName/" "./$repoName/"
+
+# Clean up: remove the temporary directory
 rm -rf "$tmpdir"
 
-echo "Repository '$repoName' has been synced into '$DST'."
+echo "Repository '$repoName' has been updated."
+echo "Note: Volume mounts (node_modules, .pnpm-store, .venv) were preserved."
diff --git a/.gitignore b/.gitignore
index fa36212d..72004381 100644
--- a/.gitignore
+++ b/.gitignore
@@ -77,7 +77,6 @@ dist
 **/logs/*.log.*
 
 # macOS dev cleanliness
-*.DS_Store
-.DS_Store
+**/.DS_Store
 
 # Ignores specific to this repository
diff --git a/extensions/context.py b/extensions/context.py
index 97cd8c43..7b6b895c 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -17,7 +17,7 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["copier_version"] = "9.11.0"
         context["copier_template_extensions_version"] = "0.3.3"
         #######
-        context["pnpm_version"] = "10.23.0"
+        context["pnpm_version"] = "10.24.0"
         # These are duplicated in the pyproject.toml of this repository
         context["pyright_version"] = "1.1.407"
         context["pytest_version"] = "9.0.1"
diff --git a/src/hash_git_files.py b/src/hash_git_files.py
index 1da0a3f7..40576d44 100644
--- a/src/hash_git_files.py
+++ b/src/hash_git_files.py
@@ -65,19 +65,16 @@ def compute_adler32(repo_path: Path, files: list[str]) -> int:
                     if not chunk:
                         break
                     checksum = zlib.adler32(chunk, checksum)
-        except Exception as e:
-            if "[Errno 21] Is a directory" in str(e):
-                # Ignore symlinks that on windows sometimes get confused as being directories
-                continue
-            print(f"Error reading file {file}: {e}", file=sys.stderr)  # noqa: T201 # this just runs as a simple script, so using print instead of log
-            raise
+        except IsADirectoryError:
+            # Ignore symlinks that on windows sometimes get confused as being directories
+            continue
 
     return checksum
 
 
 def find_devcontainer_hash_line(lines: list[str]) -> tuple[int, str | None]:
     """Find the line index and current hash in the devcontainer.json file."""
-    for i in range(len(lines) - 1, -1, -1):
+    for i in reversed(range(len(lines))):
         if lines[i].strip() == "}":
             # Check the line above it
             if i > 0:
diff --git a/template/.devcontainer/devcontainer.json.jinja-base b/template/.devcontainer/devcontainer.json.jinja-base
index 2e88e236..4a118dd6 100644
--- a/template/.devcontainer/devcontainer.json.jinja-base
+++ b/template/.devcontainer/devcontainer.json.jinja-base
@@ -2,12 +2,12 @@
   "dockerComposeFile": "docker-compose.yml",
   "service": "devcontainer",
   "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
-  "features": {
+  "features": {{% endraw %}{% if is_child_of_copier_base_template is not defined %}{% raw %}
     "ghcr.io/devcontainers/features/aws-cli:1.1.2": {
       // https://github.com/devcontainers/features/blob/main/src/aws-cli/devcontainer-feature.json
       // view latest version https://raw.githubusercontent.com/aws/aws-cli/v2/CHANGELOG.rst
-      "version": "2.31.11"
-    },
+      "version": "2.32.6",
+    },{% endraw %}{% endif %}{% raw %}
     "ghcr.io/devcontainers/features/python:1.7.1": {
       // https://github.com/devcontainers/features/blob/main/src/python/devcontainer-feature.json
       "version": "{% endraw %}{{ python_version }}{% raw %}",
@@ -24,7 +24,8 @@
   "customizations": {
     "vscode": {
       // Add the IDs of extensions you want installed when the container is created.
-      "extensions": [
+      "extensions": [{% endraw %}{% if is_child_of_copier_base_template is not defined %}{% raw %}
+        "-AmazonWebServices.aws-toolkit-vscode", // the AWS CLI feature installs this automatically, but it's causing problems in VS Code{% endraw %}{% endif %}{% raw %}
         // basic tooling
         // "eamodio.gitlens@15.5.1",
         "coderabbit.coderabbit-vscode@0.16.0",
diff --git a/template/.github/workflows/get-values.yaml.jinja-base b/template/.github/workflows/get-values.yaml.jinja-base
index 1ae071ec..6304af3f 100644
--- a/template/.github/workflows/get-values.yaml.jinja-base
+++ b/template/.github/workflows/get-values.yaml.jinja-base
@@ -9,6 +9,9 @@ on:
       dependabot-commit-created:
         description: whether or not a commit was created on a dependabot branch
         value: ${{ jobs.get-values.outputs.dependabot-commit-created }}
+      pr-short-num:
+        description: the last two digits of the PR number (to be used for fixed width naming, like Pulumi stacks)
+        value: ${{ jobs.get-values.outputs.pr-short-num }}
 
 env:
   PYTHONUNBUFFERED: True
diff --git a/template/.github/workflows/pre-commit.yaml.jinja-base b/template/.github/workflows/pre-commit.yaml.jinja-base
index 5fb0cf11..1ed8ad96 100644
--- a/template/.github/workflows/pre-commit.yaml.jinja-base
+++ b/template/.github/workflows/pre-commit.yaml.jinja-base
@@ -69,4 +69,4 @@ jobs:
             {% endraw %}{{ gha_linux_runner }}{% raw %}-py${{ inputs.python-version }}-node-${{ inputs.node-version}}-${{ env.cache-name }}-
 
       - name: Run pre-commit
-        run:  pre-commit run -a{% endraw %}
+        run: pre-commit run -a{% endraw %}