diff --git a/.github/workflows/apply.yaml b/.github/workflows/apply.yaml
index 73448df..e1b5be9 100644
--- a/.github/workflows/apply.yaml
+++ b/.github/workflows/apply.yaml
@@ -19,6 +19,14 @@ on:
         description: "One-time: comma-separated Terraform resource addresses to exclude from this apply (e.g. a resource that's known-broken and blocking every other pending change atomically, while a permanent fix is prepared). Leave empty for a normal apply."
         required: false
         default: ""
+  schedule:
+    - cron: "17 */4 * * *"
+  push:
+    paths:
+      - "**/*.tf"
+      - "**/*.csv"
+    branches:
+      - main
 
 concurrency:
   # This workflow has no pull_request trigger, so github.event.pull_request.number
diff --git a/README.md b/README.md
index d13c0a2..5643eb9 100644
--- a/README.md
+++ b/README.md
@@ -89,14 +89,12 @@ In general, you won't need to do this: the configuration is applied when a pull
 
 1. Acquire S3 credentials.
 
-    OpenTofu maintains state information about the target infrastructure; you need this state in order to plan and apply the configuration. We store this information in an S3 bucket provided by the [NERC]. You need appropriate AWS credentials in order for OpenTofu to access the cached state. These should be provided in the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables.
+    OpenTofu maintains state information about the target infrastructure; you need this state in order to plan and apply the configuration. We store this information in the `osac-terraform-state` S3 bucket (`us-east-1`) in an OSAC-controlled AWS account. The bucket is versioned, and OpenTofu takes a lock on the state (`osac.tfstate.tflock`) while it plans or applies. You need appropriate AWS credentials in order for OpenTofu to access the cached state. These should be provided in the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables.
 
 1. Acquire GitHub credentials.
 
     In order to apply the configuration, OpenTofu needs administrative access to our organization. You will need a token with at least `admin:org` and `repo` privileges for the `osac-project` organization. This should be provided in the `GITHUB_TOKEN` environment variable.
 
-[nerc]: https://nerc.mghpcc.org/
-
 ## Additional documentation
 
 - OpenTofu [introductory documentation](https://opentofu.org/docs/intro/).
diff --git a/backend.tf b/backend.tf
index 5e5c43f..5b6f1d8 100644
--- a/backend.tf
+++ b/backend.tf
@@ -9,5 +9,6 @@ terraform {
     skip_metadata_api_check     = true
     skip_region_validation      = true
     use_path_style              = true
+    use_lockfile                = true
   }
 }
diff --git a/versions.tf b/versions.tf
index f39d64f..b818412 100644
--- a/versions.tf
+++ b/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.9.0"
+  required_version = ">= 1.10.0"
   required_providers {
     github = {
       source  = "integrations/github"