diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 22cc108..34fb280 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,32 +14,44 @@ jobs:
       - name: Check out website
         uses: actions/checkout@v7
 
+      - name: Read pinned source identities
+        id: sources
+        run: |
+          echo "spec_repository=$(jq -r '.specification.repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "spec_ref=$(jq -r '.specification.ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "connect_repository=$(jq -r '.connect.repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "connect_ref=$(jq -r '.connect.ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "rust_repository=$(jq -r '.implementations[] | select(.id == "rust") | .repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "rust_ref=$(jq -r '.implementations[] | select(.id == "rust") | .ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "typescript_repository=$(jq -r '.implementations[] | select(.id == "typescript") | .repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "typescript_ref=$(jq -r '.implementations[] | select(.id == "typescript") | .ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+
       - name: Check out specification
         uses: actions/checkout@v7
         with:
-          repository: mdbase-dev/mdbase-spec
-          ref: 2c5e1bbc8736d71b95fcaea1b593dc2eeaec739b
+          repository: ${{ steps.sources.outputs.spec_repository }}
+          ref: ${{ steps.sources.outputs.spec_ref }}
           path: .sources/mdbase-spec
 
       - name: Check out Connect
         uses: actions/checkout@v7
         with:
-          repository: mdbase-dev/mdbase-connect
-          ref: c4fd2f801b12686e1fd1bd25de4a72cf9e14bc5c
+          repository: ${{ steps.sources.outputs.connect_repository }}
+          ref: ${{ steps.sources.outputs.connect_ref }}
           path: .sources/mdbase-connect
 
       - name: Check out Rust implementation
         uses: actions/checkout@v7
         with:
-          repository: callumalpass/mdbase-rs
-          ref: e9297f465f779d0bf6bb3a361abf16eaf80a6944
+          repository: ${{ steps.sources.outputs.rust_repository }}
+          ref: ${{ steps.sources.outputs.rust_ref }}
           path: .sources/mdbase-rs
 
       - name: Check out TypeScript implementation
         uses: actions/checkout@v7
         with:
-          repository: callumalpass/mdbase
-          ref: 4f419e0f4454682d42e067749db1fd16d72d1eb9
+          repository: ${{ steps.sources.outputs.typescript_repository }}
+          ref: ${{ steps.sources.outputs.typescript_ref }}
           path: .sources/mdbase
 
       - uses: pnpm/action-setup@v6
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3e733be..9511691 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -21,32 +21,44 @@ jobs:
       - name: Check out website
         uses: actions/checkout@v7
 
+      - name: Read pinned source identities
+        id: sources
+        run: |
+          echo "spec_repository=$(jq -r '.specification.repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "spec_ref=$(jq -r '.specification.ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "connect_repository=$(jq -r '.connect.repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "connect_ref=$(jq -r '.connect.ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "rust_repository=$(jq -r '.implementations[] | select(.id == "rust") | .repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "rust_ref=$(jq -r '.implementations[] | select(.id == "rust") | .ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "typescript_repository=$(jq -r '.implementations[] | select(.id == "typescript") | .repository' site-sources.json)" >> "$GITHUB_OUTPUT"
+          echo "typescript_ref=$(jq -r '.implementations[] | select(.id == "typescript") | .ref' site-sources.json)" >> "$GITHUB_OUTPUT"
+
       - name: Check out specification
         uses: actions/checkout@v7
         with:
-          repository: mdbase-dev/mdbase-spec
-          ref: 2c5e1bbc8736d71b95fcaea1b593dc2eeaec739b
+          repository: ${{ steps.sources.outputs.spec_repository }}
+          ref: ${{ steps.sources.outputs.spec_ref }}
           path: .sources/mdbase-spec
 
       - name: Check out Connect
         uses: actions/checkout@v7
         with:
-          repository: mdbase-dev/mdbase-connect
-          ref: c4fd2f801b12686e1fd1bd25de4a72cf9e14bc5c
+          repository: ${{ steps.sources.outputs.connect_repository }}
+          ref: ${{ steps.sources.outputs.connect_ref }}
           path: .sources/mdbase-connect
 
       - name: Check out Rust implementation
         uses: actions/checkout@v7
         with:
-          repository: callumalpass/mdbase-rs
-          ref: e9297f465f779d0bf6bb3a361abf16eaf80a6944
+          repository: ${{ steps.sources.outputs.rust_repository }}
+          ref: ${{ steps.sources.outputs.rust_ref }}
           path: .sources/mdbase-rs
 
       - name: Check out TypeScript implementation
         uses: actions/checkout@v7
         with:
-          repository: callumalpass/mdbase
-          ref: 4f419e0f4454682d42e067749db1fd16d72d1eb9
+          repository: ${{ steps.sources.outputs.typescript_repository }}
+          ref: ${{ steps.sources.outputs.typescript_ref }}
           path: .sources/mdbase
 
       - uses: pnpm/action-setup@v6
diff --git a/scripts/sync-sources.mjs b/scripts/sync-sources.mjs
index 9335dda..ccc88f5 100644
--- a/scripts/sync-sources.mjs
+++ b/scripts/sync-sources.mjs
@@ -66,7 +66,7 @@ cpSync(
 const manifest = yaml(join(specDir, "tests", "v0.3", "manifest.yaml"));
 const claims = [
   yaml(join(rustDir, "conformance", "v0.3.0-rc.1.yml")),
-  yaml(join(typescriptDir, "conformance", "v0.3.0-rc.1.yml"))
+  yaml(join(typescriptDir, "conformance", "v0.3.0-rc.2.yml"))
 ];
 
 const conformance = {
diff --git a/site-sources.json b/site-sources.json
index c47afde..c4c82f5 100644
--- a/site-sources.json
+++ b/site-sources.json
@@ -1,20 +1,22 @@
 {
   "specification": {
     "repository": "mdbase-dev/mdbase-spec",
-    "ref": "f0f6b5ab497f201a21723e137997b5d5d02358be"
+    "ref": "8180449530b5db54cde88383c3b96798596cc4b4"
   },
   "connect": {
     "repository": "mdbase-dev/mdbase-connect",
-    "ref": "fc94dffefb2408a756d7610f26730cac2b22a843"
+    "ref": "129d136cf082317d3ea07d25b18759b9e494526d"
   },
   "implementations": [
     {
+      "id": "rust",
       "repository": "callumalpass/mdbase-rs",
-      "ref": "99d27a245523a6f6feea950a036bd796b89f99b4"
+      "ref": "a94c364f71cd126723baaf6d027649f0144dd182"
     },
     {
+      "id": "typescript",
       "repository": "callumalpass/mdbase",
-      "ref": "893c7aee289794a353a71546a8c87e9902d684ce"
+      "ref": "b7504f9292eca1202eed6f20eea025cd917bf748"
     }
   ]
 }
diff --git a/src/data/conformance.json b/src/data/conformance.json
index 3da243d..6ca643b 100644
--- a/src/data/conformance.json
+++ b/src/data/conformance.json
@@ -29,17 +29,19 @@
     {
       "name": "mdbase",
       "language": "TypeScript",
-      "version": "0.3.0-rc.1",
+      "version": "0.3.0-rc.2",
       "repository": "https://github.com/callumalpass/mdbase",
-      "evidence_date": "2026-07-22",
+      "evidence_date": "2026-07-28",
       "profiles": [
         "core_read",
         "collection_semantics",
         "cel",
+        "cel_match",
         "cel_query",
         "links",
         "core_write",
-        "lifecycle"
+        "lifecycle",
+        "runtime_contracts/0.1"
       ],
       "optional_features": [
         "view_records"