diff --git a/README.md b/README.md
index 4286751ea..73fb3da45 100644
--- a/README.md
+++ b/README.md
@@ -196,4 +196,5 @@ Select a target environment in postman
 Run the collection
 The collections must be kept in sync manually
 
+trigger build
 <!-- vale on -->
diff --git a/config/suppliers/pack-specification/notify-admail-colour-whitemail.json b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json
new file mode 100644
index 000000000..dd735faec
--- /dev/null
+++ b/config/suppliers/pack-specification/notify-admail-colour-whitemail.json
@@ -0,0 +1,55 @@
+{
+  "assembly": {
+    "duplex": true,
+    "envelopeId": "economy-c5",
+    "features": [
+      "ADMAIL"
+    ],
+    "paper": {
+      "colour": "WHITE",
+      "id": "paper-std-white-80",
+      "name": "Standard White 80gsm",
+      "recycled": true,
+      "size": "A4",
+      "weightGSM": 80
+    },
+    "printColour": "COLOUR"
+  },
+  "billingId": "insert-admail-colour",
+  "constraints": {
+    "blackCoveragePercentage": {
+      "operator": "LESS_THAN",
+      "value": 20
+    },
+    "colourCoveragePercentage": {
+      "operator": "LESS_THAN",
+      "value": 10
+    },
+    "deliveryDays": {
+      "operator": "LESS_THAN",
+      "value": 2
+    },
+    "sheets": {
+      "operator": "LESS_THAN",
+      "value": 5
+    },
+    "sides": {
+      "operator": "LESS_THAN",
+      "value": 10
+    }
+  },
+  "createdAt": "2026-01-12T00:00:00.000Z",
+  "description": "Admail economy tariff with whitemail envelope and colour printing",
+  "id": "notify-admail-colour-whitemail",
+  "name": "Admail (colour whitemail)",
+  "postage": {
+    "deliveryDays": 4,
+    "id": "admail-economy",
+    "maxThicknessMm": 5,
+    "maxWeightGrams": 100,
+    "size": "STANDARD"
+  },
+  "status": "PROD",
+  "updatedAt": "2026-01-12T00:00:00.000Z",
+  "version": 1
+}
diff --git a/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json
new file mode 100644
index 000000000..859848c3a
--- /dev/null
+++ b/config/suppliers/supplier-pack/supplier1-notify-admail-colour-whitemail.json
@@ -0,0 +1,7 @@
+{
+  "approval": "APPROVED",
+  "id": "supplier1-notify-admail-colour-whitemail",
+  "packSpecificationId": "notify-admail-colour-whitemail",
+  "status": "PROD",
+  "supplierId": "supplier1"
+}
diff --git a/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf b/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf
index 30e418030..752f3cac9 100644
--- a/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf
+++ b/infrastructure/terraform/components/api/api_gateway_base_path_mapping.tf
@@ -2,4 +2,12 @@ resource "aws_api_gateway_base_path_mapping" "main" {
   api_id      = aws_api_gateway_rest_api.main.id
   stage_name  = aws_api_gateway_stage.main.stage_name
   domain_name = aws_api_gateway_domain_name.main.domain_name
+  depends_on = [
+    aws_api_gateway_stage.main,
+    aws_api_gateway_domain_name.main
+  ]
+
+  lifecycle {
+    replace_triggered_by = [aws_api_gateway_rest_api.main]
+  }
 }
diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api.tf b/infrastructure/terraform/components/api/api_gateway_rest_api.tf
index 1b259235e..3c9204f85 100644
--- a/infrastructure/terraform/components/api/api_gateway_rest_api.tf
+++ b/infrastructure/terraform/components/api/api_gateway_rest_api.tf
@@ -4,6 +4,10 @@ resource "aws_api_gateway_rest_api" "main" {
   description                  = "Suppliers API"
   disable_execute_api_endpoint = var.disable_gateway_execute_endpoint
 
+  endpoint_configuration {
+    types = ["REGIONAL"]
+  }
+
   lifecycle {
     replace_triggered_by = [terraform_data.rest_api_security_policy]
   }
diff --git a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf
index efef825f1..ecec65656 100644
--- a/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf
+++ b/infrastructure/terraform/components/api/api_gateway_rest_api_tls.tf
@@ -1,11 +1,12 @@
 locals {
-  rest_api_security_policy      = "SecurityPolicy_TLS12_PFS_2025_EDGE"
-  rest_api_endpoint_access_mode = "STRICT"
+  # Endpoint type for the REST API
+  # Security policy is managed at the custom domain level (see api_gateway_domain.tf: security_policy = "TLS_1_2")
+  # STRICT endpoint access mode is not supported with REGIONAL endpoints
+  rest_api_endpoint_type = "REGIONAL"
 }
 
 resource "terraform_data" "rest_api_security_policy" {
   input = {
-    security_policy      = local.rest_api_security_policy
-    endpoint_access_mode = local.rest_api_endpoint_access_mode
+    endpoint_type = local.rest_api_endpoint_type
   }
 }
diff --git a/infrastructure/terraform/components/api/api_gateway_stage.tf b/infrastructure/terraform/components/api/api_gateway_stage.tf
index 2940443d1..40ee2082c 100644
--- a/infrastructure/terraform/components/api/api_gateway_stage.tf
+++ b/infrastructure/terraform/components/api/api_gateway_stage.tf
@@ -61,4 +61,8 @@ resource "aws_api_gateway_stage" "main" {
       "status" : "$context.status"
     })
   }
+
+  lifecycle {
+    replace_triggered_by = [aws_api_gateway_rest_api.main]
+  }
 }
diff --git a/infrastructure/terraform/components/api/locals.tf b/infrastructure/terraform/components/api/locals.tf
index 517590fa8..da1e61630 100644
--- a/infrastructure/terraform/components/api/locals.tf
+++ b/infrastructure/terraform/components/api/locals.tf
@@ -7,8 +7,6 @@ locals {
   openapi_spec = templatefile("${path.module}/resources/spec.tmpl.json", {
     APIG_EXECUTION_ROLE_ARN    = aws_iam_role.api_gateway_execution_role.arn
     AWS_REGION                 = var.region
-    SECURITY_POLICY            = local.rest_api_security_policy
-    ENDPOINT_ACCESS_MODE       = local.rest_api_endpoint_access_mode
     AUTHORIZER_LAMBDA_ARN      = module.authorizer_lambda.function_arn
     GET_LETTER_LAMBDA_ARN      = module.get_letter.function_arn
     GET_LETTERS_LAMBDA_ARN     = module.get_letters.function_arn
diff --git a/infrastructure/terraform/components/api/resources/spec.tmpl.json b/infrastructure/terraform/components/api/resources/spec.tmpl.json
index 8d6430127..161d8b639 100644
--- a/infrastructure/terraform/components/api/resources/spec.tmpl.json
+++ b/infrastructure/terraform/components/api/resources/spec.tmpl.json
@@ -358,6 +358,9 @@
       ]
     }
   },
-  "x-amazon-apigateway-endpoint-access-mode": "${ENDPOINT_ACCESS_MODE}",
-  "x-amazon-apigateway-security-policy": "${SECURITY_POLICY}"
+  "x-amazon-apigateway-endpoint-configuration": {
+    "types": [
+      "REGIONAL"
+    ]
+  }
 }
diff --git a/scripts/devcontainer/Dockerfile b/scripts/devcontainer/Dockerfile
index 990163b6f..255f8d93b 100644
--- a/scripts/devcontainer/Dockerfile
+++ b/scripts/devcontainer/Dockerfile
@@ -1,5 +1,6 @@
 # syntax=docker/dockerfile:1
-FROM mcr.microsoft.com/devcontainers/base:ubuntu
+# Pin to a supported Ubuntu release; floating :ubuntu can move to unsupported codenames.
+FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
 
 # Copy CA certs and install Ruby and Go via Ubuntu packages (much faster than building from source)
 # Also install development libraries needed for Python compilation via asdf