diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 32f3a47..20e5dad 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -2,6 +2,12 @@ name: Pre-Commit
 
 on:
   workflow_call:
+    inputs:
+      trivy_scan_ref:
+        description: "Path Trivy scans in the terraform_trivy job. Narrow to e.g. 'terraform' to skip app dependency/Dockerfile scanning."
+        type: string
+        required: false
+        default: "."
 
 env:
   PY_VERSION: "3.x"
@@ -120,6 +126,15 @@ jobs:
     needs:
       [terraform_fmt, check-yaml, terraform_tflint, terraform_docs]
     steps:
+      # terraform_validate runs `terraform init` in every module directory, and each
+      # one downloads its own copy of the provider plugins (the aws provider alone is
+      # ~700 MB unpacked). On repos with many modules this exhausts the runner's ~14 GB
+      # disk ("no space left on device"). Reclaim space by removing preinstalled
+      # toolchains this job never uses. Purely additive: a no-op for small repos.
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift
+          df -h /
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -180,6 +195,7 @@ jobs:
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: "fs"
+          scan-ref: ${{ inputs.trivy_scan_ref }}
           hide-progress: false
           exit-code: "1"
           scanners: "vuln,secret,misconfig"
diff --git a/precommit-config/.tflint.hcl b/precommit-config/.tflint.hcl
index 702eb60..e90cf31 100644
--- a/precommit-config/.tflint.hcl
+++ b/precommit-config/.tflint.hcl
@@ -1,5 +1,12 @@
+# signature = "pgp" pins plugin verification to the legacy PGP key instead of the default
+# "auto", which prefers GitHub attestations. GitHub REST API 2026-03-10 dropped the `bundle`
+# field from attestation list responses; tflint unmarshals the resulting null into a nil
+# *bundle.Bundle without erroring and then panics dereferencing it during `tflint --init`.
+# Upstream: https://github.com/terraform-linters/tflint/issues/2591
+# Drop this line once that lands and the tflint we install carries the fix.
 plugin "aws" {
-    enabled = true
-    version = "0.40.0"
-    source  = "github.com/terraform-linters/tflint-ruleset-aws"
-}
\ No newline at end of file
+    enabled   = true
+    version   = "0.40.0"
+    source    = "github.com/terraform-linters/tflint-ruleset-aws"
+    signature = "pgp"
+}