diff --git a/backend/common-cdk/common_constructs/base_pipeline_stack.py b/backend/common-cdk/common_constructs/base_pipeline_stack.py
index 4531c3fc6..e947d7c72 100644
--- a/backend/common-cdk/common_constructs/base_pipeline_stack.py
+++ b/backend/common-cdk/common_constructs/base_pipeline_stack.py
@@ -39,7 +39,8 @@ def __init__(
     ):
         super().__init__(scope, construct_id, environment_name='pipeline', env=env, **kwargs)
 
-        self.env = env
+        # Note: self.env is already set by the parent Stack.__init__() call above
+        # In newer CDK versions, env is read-only after construction, so we don't reassign it
         self.environment_name = environment_name
         self.removal_policy = removal_policy
         self.access_logs_bucket = pipeline_access_logs_bucket
diff --git a/backend/common-cdk/common_constructs/frontend_app_config_utility.py b/backend/common-cdk/common_constructs/frontend_app_config_utility.py
index 1323a994b..fcdd04883 100644
--- a/backend/common-cdk/common_constructs/frontend_app_config_utility.py
+++ b/backend/common-cdk/common_constructs/frontend_app_config_utility.py
@@ -41,15 +41,17 @@ def set_staff_cognito_values(self, domain_name: str, client_id: str) -> None:
         self._config['staff_cognito_domain'] = domain_name
         self._config['staff_cognito_client_id'] = client_id
 
-    def set_domain_names(self, ui_domain_name: str, api_domain_name: str) -> None:
+    def set_domain_names(self, ui_domain_name: str, api_domain_name: str, search_api_domain_name: str) -> None:
         """
         Set UI and API domain names.
 
         :param ui_domain_name: The domain name for the UI application
         :param api_domain_name: The domain name for the API
+        :param search_api_domain_name: The domain name for the search API
         """
         self._config['ui_domain_name'] = ui_domain_name
         self._config['api_domain_name'] = api_domain_name
+        self._config['search_api_domain_name'] = search_api_domain_name
 
     def set_license_bulk_uploads_bucket_name(self, bucket_name: str) -> None:
         """
@@ -200,6 +202,7 @@ def _create_dummy_values() -> 'PersistentStackFrontendAppConfigValues':
             'provider_cognito_client_id': 'test-provider-client-id',
             'ui_domain_name': 'test-ui.example.com',
             'api_domain_name': 'test-api.example.com',
+            'search_api_domain_name': 'test-search-api.example.com',
             'bulk_uploads_bucket_name': 'test-bulk-uploads-bucket-name',
             'provider_users_bucket_name': 'test-provider-users-bucket-name',
             # if we are working with dummy values, no need to run an actual bundle
@@ -227,6 +230,11 @@ def api_domain_name(self) -> str:
         """Get the domain name for the API."""
         return self._config['api_domain_name']
 
+    @property
+    def search_api_domain_name(self) -> str:
+        """Get the domain name for the search API."""
+        return self._config['search_api_domain_name']
+
     @property
     def bulk_uploads_bucket_name(self) -> str:
         """Get the name of the bulk uploads bucket."""
diff --git a/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/index.js b/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/index.js
index 023e59629..9068048ba 100644
--- a/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/index.js
+++ b/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/index.js
@@ -19,6 +19,7 @@
 const environmentValues = {
     webFrontend: `##WEB_FRONTEND##`,
     dataApi: `##DATA_API##`,
+    searchApi: `##SEARCH_API##`,
     s3UploadUrlState: `##S3_UPLOAD_URL_STATE##`,
     s3UploadUrlProvider: `##S3_UPLOAD_URL_PROVIDER##`,
     cognitoStaff: `##COGNITO_STAFF##`,
@@ -62,6 +63,7 @@ const getEnvironmentUrls = () => {
     const environmentUrls = {};
 
     environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);
+    environmentUrls.searchApi = getFullyQualified(environmentValues.searchApi);
     environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);
     environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);
     environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);
@@ -237,6 +239,7 @@ const setCspHeader = (headers = {}) => {
             buildSrcString('connect-src', [
                 'self',
                 domains.dataApi,
+                domains.searchApi,
                 domains.s3UploadUrlState,
                 domains.s3UploadUrlProvider,
                 domains.cognitoStaff,
diff --git a/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/test/index.test.js b/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/test/index.test.js
index 8aefe2f8d..3d7e73b8e 100644
--- a/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/test/index.test.js
+++ b/backend/compact-connect-ui-app/lambdas/nodejs/cloudfront-csp/test/index.test.js
@@ -20,6 +20,7 @@ const {
 const environmentValues = {
     webFrontend: 'app.compactconnect.org',
     dataApi: 'api.compactconnect.org',
+    searchApi: 'search.compactconnect.org',
     s3UploadUrlState: 'prod-persistentstack-bulkuploadsbucketda4bdcd0-zq5o0q8uqq5i.s3.amazonaws.com',
     s3UploadUrlProvider: 'prod-persistentstack-providerusersbucket5c7b202b-ffpgh4fyozwk.s3.amazonaws.com',
     cognitoStaff: 'staff-auth.compactconnect.org',
@@ -46,6 +47,7 @@ const prepareLambdaForTest = () => {
     const replacements = {
         '##WEB_FRONTEND##': environmentValues.webFrontend,
         '##DATA_API##': environmentValues.dataApi,
+        '##SEARCH_API##': environmentValues.searchApi,
         '##S3_UPLOAD_URL_STATE##': environmentValues.s3UploadUrlState,
         '##S3_UPLOAD_URL_PROVIDER##': environmentValues.s3UploadUrlProvider,
         '##COGNITO_STAFF##': environmentValues.cognitoStaff,
@@ -69,6 +71,7 @@ const prepareLambdaForTest = () => {
 
 const buildCspHeaders = (environment) => {
     const dataApiUrl = (environment?.dataApi) ? `https://${environment.dataApi}` : '';
+    const searchApiUrl = (environment?.searchApi) ? `https://${environment.searchApi}` : '';
     const s3UploadUrlState = (environment?.s3UploadUrlState) ? `https://${environment.s3UploadUrlState}` : '';
     const s3UploadUrlProvider = (environment?.s3UploadUrlProvider) ? `https://${environment.s3UploadUrlProvider}` : '';
     const cognitoStaffUrl = (environment?.cognitoStaff) ? `https://${environment.cognitoStaff}` : '';
@@ -150,6 +153,7 @@ const buildCspHeaders = (environment) => {
     const cspConnectSrc = [
         '\'self\'',
         dataApiUrl,
+        searchApiUrl,
         s3UploadUrlState,
         s3UploadUrlProvider,
         cognitoStaffUrl,
diff --git a/backend/compact-connect-ui-app/lambdas/nodejs/package.json b/backend/compact-connect-ui-app/lambdas/nodejs/package.json
index d5b458edd..8ffb19d76 100644
--- a/backend/compact-connect-ui-app/lambdas/nodejs/package.json
+++ b/backend/compact-connect-ui-app/lambdas/nodejs/package.json
@@ -9,7 +9,7 @@
     "test:csp": "mocha cloudfront-csp/test",
     "lint": "eslint '**/*.js' --no-error-on-unmatched-pattern",
     "test": "mocha cloudfront-csp/test",
-    "audit:dependencies": "yarn audit --groups dependencies --level moderate"
+    "audit:dependencies": "/bin/bash -c 'yarn audit --groups dependencies --level moderate; [[ $? -ge 4 ]] && exit 1 || exit 0'"
   },
   "author": "Inspiring Apps",
   "license": "UNLICENSED",
diff --git a/backend/compact-connect-ui-app/requirements-dev.txt b/backend/compact-connect-ui-app/requirements-dev.txt
index a8d4c0ea1..976e695f7 100644
--- a/backend/compact-connect-ui-app/requirements-dev.txt
+++ b/backend/compact-connect-ui-app/requirements-dev.txt
@@ -6,27 +6,27 @@
 #
 boolean-py==5.0
     # via license-expression
-build==1.3.0
+build==1.4.0
     # via pip-tools
 cachecontrol[filecache]==0.14.4
     # via
     #   cachecontrol
     #   pip-audit
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 charset-normalizer==3.4.4
     # via requests
 click==8.3.1
     # via pip-tools
-coverage[toml]==7.12.0
+coverage[toml]==7.13.1
     # via
     #   -r requirements-dev.in
     #   pytest-cov
-cyclonedx-python-lib==9.1.0
+cyclonedx-python-lib==11.6.0
     # via pip-audit
 defusedxml==0.7.1
     # via py-serializable
-filelock==3.20.0
+filelock==3.20.3
     # via cachecontrol
 idna==3.11
     # via requests
@@ -40,7 +40,7 @@ mdurl==0.1.2
     # via markdown-it-py
 msgpack==1.1.2
     # via cachecontrol
-packageurl-python==0.17.5
+packageurl-python==0.17.6
     # via cyclonedx-python-lib
 packaging==25.0
     # via
@@ -50,13 +50,13 @@ packaging==25.0
     #   pytest
 pip-api==0.0.34
     # via pip-audit
-pip-audit==2.9.0
+pip-audit==2.10.0
     # via -r requirements-dev.in
 pip-requirements-parser==32.0.1
     # via pip-audit
 pip-tools==7.5.2
     # via -r requirements-dev.in
-platformdirs==4.5.0
+platformdirs==4.5.1
     # via pip-audit
 pluggy==1.6.0
     # via
@@ -68,13 +68,13 @@ pygments==2.19.2
     # via
     #   pytest
     #   rich
-pyparsing==3.2.5
+pyparsing==3.3.1
     # via pip-requirements-parser
 pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-pytest==9.0.1
+pytest==9.0.2
     # via
     #   -r requirements-dev.in
     #   pytest-cov
@@ -86,13 +86,15 @@ requests==2.32.5
     #   pip-audit
 rich==14.2.0
     # via pip-audit
-ruff==0.14.6
+ruff==0.14.11
     # via -r requirements-dev.in
 sortedcontainers==2.4.0
     # via cyclonedx-python-lib
-toml==0.10.2
+tomli==2.4.0
     # via pip-audit
-urllib3==2.5.0
+tomli-w==1.2.0
+    # via pip-audit
+urllib3==2.6.3
     # via requests
 wheel==0.45.1
     # via pip-tools
diff --git a/backend/compact-connect-ui-app/requirements.txt b/backend/compact-connect-ui-app/requirements.txt
index 260804a65..4c4f8ab00 100644
--- a/backend/compact-connect-ui-app/requirements.txt
+++ b/backend/compact-connect-ui-app/requirements.txt
@@ -8,15 +8,15 @@ attrs==25.4.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.242
+aws-cdk-asset-awscli-v1==2.2.258
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.227.0a0
+aws-cdk-aws-lambda-python-alpha==2.234.1a0
     # via -r requirements.in
 aws-cdk-cloud-assembly-schema==48.20.0
     # via aws-cdk-lib
-aws-cdk-lib==2.227.0
+aws-cdk-lib==2.234.1
     # via
     #   -r requirements.in
     #   aws-cdk-aws-lambda-python-alpha
@@ -25,7 +25,7 @@ cattrs==25.3.0
     # via jsii
 cdk-nag==2.37.55
     # via -r requirements.in
-constructs==10.4.3
+constructs==10.4.4
     # via
     #   -r requirements.in
     #   aws-cdk-aws-lambda-python-alpha
@@ -33,7 +33,7 @@ constructs==10.4.3
     #   cdk-nag
 importlib-resources==6.5.2
     # via jsii
-jsii==1.119.0
+jsii==1.125.0
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-node-proxy-agent-v6
@@ -58,7 +58,7 @@ pyyaml==6.0.3
     # via -r requirements.in
 six==1.17.0
     # via python-dateutil
-typeguard==4.2.1
+typeguard==2.13.3
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-node-proxy-agent-v6
diff --git a/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/deployment.py b/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/deployment.py
index 7af4d997f..dc6f714f1 100644
--- a/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/deployment.py
+++ b/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/deployment.py
@@ -62,7 +62,7 @@ def __init__(
                                 'VUE_APP_ROBOTS_META': robots_meta,
                                 'VUE_APP_API_STATE_ROOT': f'{HTTPS_PREFIX}{persistent_stack_app_config_values.api_domain_name}',
                                 'VUE_APP_API_LICENSE_ROOT': f'{HTTPS_PREFIX}{persistent_stack_app_config_values.api_domain_name}',
-                                'VUE_APP_API_SEARCH_ROOT': f'{HTTPS_PREFIX}search.{persistent_stack_app_config_values.api_domain_name}',
+                                'VUE_APP_API_SEARCH_ROOT': f'{HTTPS_PREFIX}{persistent_stack_app_config_values.search_api_domain_name}',
                                 'VUE_APP_API_USER_ROOT': f'{HTTPS_PREFIX}{persistent_stack_app_config_values.api_domain_name}',
                                 'VUE_APP_COGNITO_REGION': 'us-east-1',
                                 'VUE_APP_COGNITO_AUTH_DOMAIN_STAFF': f'{HTTPS_PREFIX}{persistent_stack_app_config_values.staff_cognito_domain}',
diff --git a/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/distribution.py b/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/distribution.py
index ce1bff8e0..d9a3e781e 100644
--- a/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/distribution.py
+++ b/backend/compact-connect-ui-app/stacks/frontend_deployment_stack/distribution.py
@@ -57,6 +57,7 @@ def generate_csp_lambda_code(
     replacements = {
         '##WEB_FRONTEND##': persistent_stack_values.ui_domain_name,
         '##DATA_API##': persistent_stack_values.api_domain_name,
+        '##SEARCH_API##': persistent_stack_values.search_api_domain_name,
         '##S3_UPLOAD_URL_STATE##': f'{persistent_stack_values.bulk_uploads_bucket_name}{S3_URL_SUFFIX}',
         '##S3_UPLOAD_URL_PROVIDER##': f'{persistent_stack_values.provider_users_bucket_name}{S3_URL_SUFFIX}',
         '##COGNITO_STAFF##': persistent_stack_values.staff_cognito_domain,
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
index dfa9bf6bc..385fb6a91 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
@@ -39,7 +39,7 @@
             {
               "EventType": "viewer-response",
               "LambdaFunctionARN": {
-                "Ref": "CSPFunctionCurrentVersionB61A66110cf6f5eb1eee31df1d009e18023c5c92"
+                "Ref": "CSPFunctionCurrentVersionB61A6611b3705bb7a3e3440bc14c943a82111069"
               }
             }
           ],
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
index b5ec5e8a0..3daaba274 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/BetaFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
@@ -2,7 +2,7 @@
   "Type": "AWS::Lambda::Function",
   "Properties": {
     "Code": {
-      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
+      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    searchApi: `test-search-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.searchApi = getFullyQualified(environmentValues.searchApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.searchApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
     },
     "Handler": "index.handler",
     "Role": {
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
index cd574ec64..d9148924a 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
@@ -39,7 +39,7 @@
             {
               "EventType": "viewer-response",
               "LambdaFunctionARN": {
-                "Ref": "CSPFunctionCurrentVersionB61A66110cf6f5eb1eee31df1d009e18023c5c92"
+                "Ref": "CSPFunctionCurrentVersionB61A6611b3705bb7a3e3440bc14c943a82111069"
               }
             }
           ],
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
index b5ec5e8a0..3daaba274 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/ProdFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
@@ -2,7 +2,7 @@
   "Type": "AWS::Lambda::Function",
   "Properties": {
     "Code": {
-      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
+      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    searchApi: `test-search-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.searchApi = getFullyQualified(environmentValues.searchApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.searchApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
     },
     "Handler": "index.handler",
     "Role": {
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION.json
index a69e9382b..b3394318b 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION.json
@@ -39,7 +39,7 @@
             {
               "EventType": "viewer-response",
               "LambdaFunctionARN": {
-                "Ref": "CSPFunctionCurrentVersionB61A66110cf6f5eb1eee31df1d009e18023c5c92"
+                "Ref": "CSPFunctionCurrentVersionB61A6611b3705bb7a3e3440bc14c943a82111069"
               }
             }
           ],
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
index b5ec5e8a0..3daaba274 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/SandboxUI-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
@@ -2,7 +2,7 @@
   "Type": "AWS::Lambda::Function",
   "Properties": {
     "Code": {
-      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
+      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    searchApi: `test-search-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.searchApi = getFullyQualified(environmentValues.searchApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.searchApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
     },
     "Handler": "index.handler",
     "Role": {
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
index f0d59c275..fa058f2b2 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION.json
@@ -39,7 +39,7 @@
             {
               "EventType": "viewer-response",
               "LambdaFunctionARN": {
-                "Ref": "CSPFunctionCurrentVersionB61A66110cf6f5eb1eee31df1d009e18023c5c92"
+                "Ref": "CSPFunctionCurrentVersionB61A6611b3705bb7a3e3440bc14c943a82111069"
               }
             }
           ],
diff --git a/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json b/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
index b5ec5e8a0..3daaba274 100644
--- a/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
+++ b/backend/compact-connect-ui-app/tests/resources/snapshots/TestFrontend-FrontendDeploymentStack-UI_DISTRIBUTION_LAMBDA_FUNCTION.json
@@ -2,7 +2,7 @@
   "Type": "AWS::Lambda::Function",
   "Properties": {
     "Code": {
-      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
+      "ZipFile": "//\n//  index.js\n//  CompactConnect\n//\n//  Created by InspiringApps on 7/22/2024.\n//\n\n// ============================================================================\n//                               CONFIGURATION                                =\n// ============================================================================\n/**\n * Configuration of supported domains.\n *\n * These values are injected into the lambda function at build time. See the\n * `generate_csp_lambda_code` function in\n * backend/compact-connect/stacks/frontend_deployment_stack/distribution.py\n * @type {object}\n */\nconst environmentValues = {\n    webFrontend: `test-ui.example.com`,\n    dataApi: `test-api.example.com`,\n    searchApi: `test-search-api.example.com`,\n    s3UploadUrlState: `test-bulk-uploads-bucket-name.s3.amazonaws.com`,\n    s3UploadUrlProvider: `test-provider-users-bucket-name.s3.amazonaws.com`,\n    cognitoStaff: `test-staff-domain`,\n    cognitoProvider: `test-provider-domain`,\n};\n\n// ============================================================================\n//                                   HELPERS                                  =\n// ============================================================================\n/**\n * Get the request domain from the lambda event record.\n * @param  {object} eventRecord The cloudfront record from the lambda event.\n * @return {string}             The bare domain of the request domain.\n */\n\n/**\n * Get a fully qualified domain URI with the protocol scheme.\n * @param  {string} domain The bare domain string.\n * @return {string}        The fully-qualified domain string.\n */\nconst getFullyQualified = (domain) => {\n    const protocol = 'https://';\n    let fullyQualified = '';\n\n    if (domain && typeof domain === 'string' && !domain.startsWith(protocol)) {\n        fullyQualified = `${protocol}${domain}`;\n    }\n\n    return fullyQualified;\n};\n\n/**\n * Helper to get the fully-qualified domains for connected services.\n * @return {object}               A map of fully-qualified domains for the environment.\n *   @return {string} dataApi       The data API fully-qualified domain.\n *   @return {string} s3UploadUrlState      The S3 fully-qualified domain for uploading state files.\n *   @return {string} s3UploadUrlProvider      The S3 fully-qualified domain for uploading provider files.\n *   @return {string} cognitoStaff  The Cognito fully-qualified domain for authenticating staff users.\n */\nconst getEnvironmentUrls = () => {\n    const environmentUrls = {};\n\n    environmentUrls.dataApi = getFullyQualified(environmentValues.dataApi);\n    environmentUrls.searchApi = getFullyQualified(environmentValues.searchApi);\n    environmentUrls.s3UploadUrlState = getFullyQualified(environmentValues.s3UploadUrlState);\n    environmentUrls.s3UploadUrlProvider = getFullyQualified(environmentValues.s3UploadUrlProvider);\n    environmentUrls.cognitoStaff = getFullyQualified(environmentValues.cognitoStaff);\n    environmentUrls.cognitoProvider = getFullyQualified(environmentValues.cognitoProvider);\n\n    return environmentUrls;\n};\n\n/**\n * Helper to escape CSP src keywords.\n * @param  {string} keyword The standard keyword value.\n * @return {string}         The escaped keyword value.\n */\nconst srcKeywordEscape = (keyword) => {\n    let escaped = '';\n\n    if (keyword && typeof keyword === 'string') {\n        escaped = `'${keyword}'`.toLowerCase();\n    }\n\n    return escaped;\n};\n\n/**\n * Helper to automatically escape and prep CSP src keyword values (by reference).\n * @param  {Array<string>} srcList       The CSP src list.\n * @param  {string}        [listName=''] Optional src list name for logging.\n */\nconst srcKeywordsEscape = (srcList, listName = '') => {\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#keyword_values\n    const srcKeywordsConfig = [\n        { value: 'self', isAllowed: true },\n        { value: 'none', isAllowed: true },\n        { value: 'strict-dynamic', isAllowed: true },\n        { value: 'report-sample', isAllowed: true },\n        { value: 'inline-speculation-rules', isAllowed: true },\n        { value: 'unsafe-inline', isAllowed: false },\n        { value: 'unsafe-eval', isAllowed: false },\n        { value: 'unsafe-hashes', isAllowed: false },\n        { value: 'wasm-unsafe-eval', isAllowed: false },\n    ];\n    const srcKeywords = srcKeywordsConfig.map((config) => config.value.toLowerCase());\n\n    if (Array.isArray(srcList)) {\n        srcList.forEach((srcItem, idx) => {\n            const isString = typeof srcItem === 'string';\n\n            if (!isString) {\n                srcList[idx] = '';\n            } else {\n                const srcItemLowerCase = srcItem.toLowerCase();\n\n                if (srcKeywords.includes(srcItemLowerCase)) {\n                    const keywordConfig = srcKeywordsConfig.find(\n                        (config) => srcItemLowerCase === config.value.toLowerCase()\n                    );\n\n                    if (keywordConfig) {\n                        if (!keywordConfig.isAllowed) {\n                            console.warn(`${listName} ${srcItem} keyword is not allowed in srcKeywordsConfig policy. We likely should not be using this keyword for security reasons.`.trim());\n                            srcList[idx] = '';\n                        } else {\n                            srcList[idx] = srcKeywordEscape(srcItem);\n                        }\n                    }\n                }\n            }\n        });\n    }\n};\n\n/**\n * Helper to build a CSP src group list string from input params.\n * @param  {string}        name src name for the CSP group.\n * @param  {Array<string>} list The static src list for the CSP group.\n * @return {string}             The prepped src list string;\n */\nconst buildSrcString = (name = '', list = []) => {\n    let srcString = '';\n\n    if (Array.isArray(list)) {\n        srcKeywordsEscape(list, name);\n        srcString = `${name} ${list.join(' ')};`;\n    }\n\n    return srcString;\n};\n\n// ============================================================================\n//                               RESPONSE HEADERS                             =\n// ============================================================================\n/**\n * Set the CSP header on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setCspHeader = (headers = {}) => {\n    const domains = getEnvironmentUrls();\n    const cognitoIdpUrl = 'https://cognito-idp.us-east-1.amazonaws.com';\n\n    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy\n    headers['content-security-policy'] = [{\n        key: 'Content-Security-Policy',\n        value: `${[\n            `default-src 'none';`,\n            buildSrcString('manifest-src', [\n                'self',\n            ]),\n            buildSrcString('script-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-elem', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://www.gstatic.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('script-src-attr', [\n                'self',\n            ]),\n            buildSrcString('worker-src', [\n                'self',\n            ]),\n            buildSrcString('style-src', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('style-src-elem', [\n                'self',\n                'https://fonts.googleapis.com',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n                `'sha256-YwWQHXh4Vw0oD2Oo8pV9huEF2sE9mD8i5nZUuHzEg9A='`, // <style> tag injected by authorize.net widget\n            ]),\n            buildSrcString('style-src-attr', [\n                'self',\n            ]),\n            buildSrcString('font-src', [\n                'self',\n                'https://fonts.gstatic.com',\n            ]),\n            buildSrcString('img-src', [\n                'self',\n                'data:',\n                domains.dataApi,\n                'https://www.gstatic.com/recaptcha/',\n            ]),\n            buildSrcString('media-src', [\n                'self',\n                domains.dataApi,\n            ]),\n            buildSrcString('frame-src', [\n                'self',\n                'https://www.google.com/recaptcha/',\n                'https://recaptcha.google.com/recaptcha/',\n                'https://jstest.authorize.net/',\n                'https://js.authorize.net/',\n            ]),\n            buildSrcString('frame-ancestors', [\n                'none'\n            ]),\n            buildSrcString('object-src', [\n                'none',\n            ]),\n            buildSrcString('form-action', [\n                'none',\n            ]),\n            buildSrcString('connect-src', [\n                'self',\n                domains.dataApi,\n                domains.searchApi,\n                domains.s3UploadUrlState,\n                domains.s3UploadUrlProvider,\n                domains.cognitoStaff,\n                domains.cognitoProvider,\n                cognitoIdpUrl,\n                'https://www.google.com/recaptcha/',\n                // Begin Statsig domains\n                'https://api.statsig.com/',\n                'https://featuregates.org/',\n                'https://statsigapi.net/',\n                'https://events.statsigapi.net/',\n                'https://api.statsigcdn.com/',\n                'https://featureassets.org/',\n                'https://assetsconfigcdn.org/',\n                'https://prodregistryv2.org/',\n                'https://cloudflare-dns.com/',\n                'https://beyondwickedmapping.org/',\n                // End Statsig domains\n            ]),\n        ].join(' ')}`,\n    }];\n};\n\n/**\n * Set security headers on the response (by reference).\n * @param {object} [headers={}]  The event response headers (updated by reference).\n */\nconst setSecurityHeaders = (headers = {}) => {\n    // Strict-Transport-Security\n    headers['strict-transport-security'] = [{\n        key: 'Strict-Transport-Security',\n        value: 'max-age=31536000; includeSubdomains; preload',\n    }];\n    // X-Content-Type-Options\n    headers['x-content-type-options'] = [{\n        key: 'X-Content-Type-Options',\n        value: 'nosniff',\n    }];\n    // X-Frame-Options\n    headers['x-frame-options'] = [{\n        key: 'X-Frame-Options',\n        value: 'DENY',\n    }];\n    // Referrer-Policy\n    headers['referrer-policy'] = [{\n        key: 'Referrer-Policy',\n        value: 'strict-origin-when-cross-origin',\n    }];\n    // Server\n    headers.server = [{\n        key: 'Server',\n        value: 'CompactConnect',\n    }];\n    // Content-Security-Policy\n    setCspHeader(headers);\n};\n\n// ============================================================================\n//                                 LAMBDA ENTRY                               =\n// ============================================================================\nexports.handler = async (event) => {\n    // https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-event-structure.html\n    const eventRecord = event?.Records[0]?.cf || {};\n    const response = eventRecord.response || {};\n    const responseHeaders = response.headers || {};\n\n    setSecurityHeaders(responseHeaders);\n\n    return response;\n};\n"
     },
     "Handler": "index.handler",
     "Role": {
diff --git a/backend/compact-connect/lambdas/nodejs/package.json b/backend/compact-connect/lambdas/nodejs/package.json
index 5b1eaa1b9..5975fe39d 100644
--- a/backend/compact-connect/lambdas/nodejs/package.json
+++ b/backend/compact-connect/lambdas/nodejs/package.json
@@ -9,7 +9,7 @@
     "lint:fix": "eslint '**/*.ts' --fix",
     "lint": "eslint '**/*.ts'",
     "test": "NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\" jest --coverage",
-    "audit:dependencies": "yarn audit --groups dependencies --level moderate"
+    "audit:dependencies": "/bin/bash -c 'yarn audit --groups dependencies --level moderate; [[ $? -ge 4 ]] && exit 1 || exit 0'"
   },
   "author": "Inspiring Apps",
   "license": "UNLICENSED",
diff --git a/backend/compact-connect/lambdas/python/cognito-backup/requirements-dev.txt b/backend/compact-connect/lambdas/python/cognito-backup/requirements-dev.txt
index 184c65492..283f44ee4 100644
--- a/backend/compact-connect/lambdas/python/cognito-backup/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/cognito-backup/requirements-dev.txt
@@ -4,19 +4,19 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/cognito-backup/requirements-dev.in
 #
-aws-lambda-powertools==3.23.0
+aws-lambda-powertools==3.24.0
     # via -r lambdas/python/cognito-backup/requirements-dev.in
-boto3==1.42.11
+boto3==1.42.25
     # via
     #   -r lambdas/python/cognito-backup/requirements-dev.in
     #   moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   -r lambdas/python/cognito-backup/requirements-dev.in
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -37,13 +37,13 @@ jmespath==1.0.1
     #   aws-lambda-powertools
     #   boto3
     #   botocore
-joserfc==1.6.0
+joserfc==1.6.1
     # via moto
 markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,s3]==5.1.18
+moto[cognitoidp,s3]==5.1.19
     # via -r lambdas/python/cognito-backup/requirements-dev.in
 packaging==25.0
     # via pytest
@@ -77,12 +77,12 @@ six==1.17.0
     # via python-dateutil
 typing-extensions==4.15.0
     # via aws-lambda-powertools
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/cognito-backup/requirements.txt b/backend/compact-connect/lambdas/python/cognito-backup/requirements.txt
index b9089934d..01d53ad01 100644
--- a/backend/compact-connect/lambdas/python/cognito-backup/requirements.txt
+++ b/backend/compact-connect/lambdas/python/cognito-backup/requirements.txt
@@ -4,11 +4,11 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/cognito-backup/requirements.in
 #
-aws-lambda-powertools==3.23.0
+aws-lambda-powertools==3.24.0
     # via -r lambdas/python/cognito-backup/requirements.in
-boto3==1.42.11
+boto3==1.42.25
     # via -r lambdas/python/cognito-backup/requirements.in
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   -r lambdas/python/cognito-backup/requirements.in
     #   boto3
@@ -26,5 +26,5 @@ six==1.17.0
     # via python-dateutil
 typing-extensions==4.15.0
     # via aws-lambda-powertools
-urllib3==2.6.2
+urllib3==2.6.3
     # via botocore
diff --git a/backend/compact-connect/lambdas/python/common/requirements-dev.txt b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
index a59a86d41..67d729bc4 100644
--- a/backend/compact-connect/lambdas/python/common/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements-dev.txt
@@ -12,31 +12,33 @@ attrs==25.4.0
     # via
     #   jsonschema
     #   referencing
-aws-sam-translator==1.105.0
-    # via cfn-lint
+aws-sam-translator==1.103.0
+    # via
+    #   cfn-lint
+    #   moto
 aws-xray-sdk==2.15.0
     # via moto
-boto3==1.42.11
+boto3==1.42.25
     # via
     #   aws-sam-translator
     #   moto
-boto3-stubs[full]==1.42.11
+boto3-stubs[full]==1.42.25
     # via -r lambdas/python/common/requirements-dev.in
-boto3-stubs-full==1.42.10
+boto3-stubs-full==1.42.25
     # via boto3-stubs
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   aws-xray-sdk
     #   boto3
     #   moto
     #   s3transfer
-botocore-stubs==1.42.11
+botocore-stubs==1.42.25
     # via boto3-stubs
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
-cfn-lint==1.43.0
+cfn-lint==1.41.0
     # via moto
 charset-normalizer==3.4.4
     # via requests
@@ -59,7 +61,7 @@ jmespath==1.0.1
     # via
     #   boto3
     #   botocore
-joserfc==1.6.0
+joserfc==1.6.1
     # via moto
 jsonpatch==1.33
     # via cfn-lint
@@ -67,7 +69,7 @@ jsonpath-ng==1.7.0
     # via moto
 jsonpointer==3.0.0
     # via jsonpatch
-jsonschema==4.25.1
+jsonschema==4.26.0
     # via
     #   aws-sam-translator
     #   moto
@@ -85,7 +87,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[all]==5.1.18
+moto[all]==5.1.19
     # via -r lambdas/python/common/requirements-dev.in
 mpmath==1.3.0
     # via sympy
@@ -105,11 +107,13 @@ py-partiql-parser==0.6.3
     # via moto
 pycparser==2.23
     # via cffi
-pydantic==2.12.5
-    # via aws-sam-translator
+pydantic==2.12.4
+    # via
+    #   aws-sam-translator
+    #   moto
 pydantic-core==2.41.5
     # via pydantic
-pyparsing==3.2.5
+pyparsing==3.3.1
     # via moto
 python-dateutil==2.9.0.post0
     # via
@@ -150,7 +154,7 @@ six==1.17.0
     #   rfc3339-validator
 sympy==1.14.0
     # via cfn-lint
-types-awscrt==0.30.0
+types-awscrt==0.31.0
     # via botocore-stubs
 types-s3transfer==0.16.0
     # via boto3-stubs
@@ -165,13 +169,13 @@ typing-inspection==0.4.2
     # via pydantic
 tzdata==2025.3
     # via faker
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 wrapt==2.0.1
     # via aws-xray-sdk
diff --git a/backend/compact-connect/lambdas/python/common/requirements.txt b/backend/compact-connect/lambdas/python/common/requirements.txt
index 632ab69b1..5aef13d97 100644
--- a/backend/compact-connect/lambdas/python/common/requirements.txt
+++ b/backend/compact-connect/lambdas/python/common/requirements.txt
@@ -8,15 +8,15 @@ argon2-cffi==25.1.0
     # via -r lambdas/python/common/requirements.in
 argon2-cffi-bindings==25.1.0
     # via argon2-cffi
-aws-lambda-powertools==3.23.0
+aws-lambda-powertools==3.24.0
     # via -r lambdas/python/common/requirements.in
-boto3==1.42.11
+boto3==1.42.25
     # via -r lambdas/python/common/requirements.in
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via
@@ -33,7 +33,7 @@ jmespath==1.0.1
     #   aws-lambda-powertools
     #   boto3
     #   botocore
-marshmallow==3.26.1
+marshmallow==3.26.2
     # via -r lambdas/python/common/requirements.in
 packaging==25.0
     # via marshmallow
@@ -49,7 +49,7 @@ six==1.17.0
     # via python-dateutil
 typing-extensions==4.15.0
     # via aws-lambda-powertools
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   requests
diff --git a/backend/compact-connect/lambdas/python/compact-configuration/requirements-dev.txt b/backend/compact-connect/lambdas/python/compact-configuration/requirements-dev.txt
index 1f5e19463..d9ec365c3 100644
--- a/backend/compact-connect/lambdas/python/compact-configuration/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/compact-configuration/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/compact-configuration/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/compact-configuration/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -58,13 +58,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
index a751a4574..2a0c990ce 100644
--- a/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/custom-resources/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/custom-resources/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/custom-resources/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -58,13 +58,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
index a31fe9b7a..a6e962714 100644
--- a/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/data-events/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/data-events/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/data-events/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -58,13 +58,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/disaster-recovery/requirements-dev.txt b/backend/compact-connect/lambdas/python/disaster-recovery/requirements-dev.txt
index 834cf4a1c..9c81da763 100644
--- a/backend/compact-connect/lambdas/python/disaster-recovery/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/disaster-recovery/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/disaster-recovery/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/disaster-recovery/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -58,13 +58,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
index 178f7bf50..9a2b0299b 100644
--- a/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/provider-data-v1/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/provider-data-v1/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -35,7 +35,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/provider-data-v1/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -62,13 +62,13 @@ six==1.17.0
     # via python-dateutil
 tzdata==2025.3
     # via faker
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.in b/backend/compact-connect/lambdas/python/purchases/requirements-dev.in
index c4c8851a6..689626300 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.in
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.in
@@ -14,4 +14,4 @@ boto3>=1.34.33, <2
 cryptography>=46, <47
 marshmallow>=3.21.3, <4.0.0
 requests>=2.31.0, <3.0.0
-urllib3>=2.6.0, <3
+urllib3>=2.6.3, <3
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
index d74008ce4..81ff3297d 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements-dev.txt
@@ -2,32 +2,32 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/purchases/requirements-dev.in
+#    pip-compile --no-emit-index-url --no-strip-extras requirements-dev.in
 #
 argon2-cffi==25.1.0
-    # via -r lambdas/python/purchases/requirements-dev.in
+    # via -r requirements-dev.in
 argon2-cffi-bindings==25.1.0
     # via argon2-cffi
-aws-lambda-powertools==3.23.0
-    # via -r lambdas/python/purchases/requirements-dev.in
+aws-lambda-powertools==3.24.0
+    # via -r requirements-dev.in
 boolean-py==5.0
     # via license-expression
-boto3==1.42.11
+boto3==1.42.25
     # via
-    #   -r lambdas/python/purchases/requirements-dev.in
+    #   -r requirements-dev.in
     #   moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-build==1.3.0
+build==1.4.0
     # via pip-tools
 cachecontrol[filecache]==0.14.4
     # via
     #   cachecontrol
     #   pip-audit
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via
@@ -37,13 +37,13 @@ charset-normalizer==3.4.4
     # via requests
 click==8.3.1
     # via pip-tools
-coverage[toml]==7.13.0
+coverage[toml]==7.13.1
     # via
-    #   -r lambdas/python/purchases/requirements-dev.in
+    #   -r requirements-dev.in
     #   pytest-cov
 cryptography==46.0.3
     # via
-    #   -r lambdas/python/purchases/requirements-dev.in
+    #   -r requirements-dev.in
     #   moto
 cyclonedx-python-lib==11.6.0
     # via pip-audit
@@ -52,8 +52,8 @@ defusedxml==0.7.1
 docker==7.1.0
     # via moto
 faker==37.12.0
-    # via -r lambdas/python/purchases/requirements-dev.in
-filelock==3.20.1
+    # via -r requirements-dev.in
+filelock==3.20.3
     # via cachecontrol
 idna==3.11
     # via requests
@@ -75,11 +75,11 @@ markupsafe==3.0.3
     #   jinja2
     #   werkzeug
 marshmallow==3.26.2
-    # via -r lambdas/python/purchases/requirements-dev.in
+    # via -r requirements-dev.in
 mdurl==0.1.2
     # via markdown-it-py
-moto[dynamodb,s3]==5.1.18
-    # via -r lambdas/python/purchases/requirements-dev.in
+moto[dynamodb,s3]==5.1.19
+    # via -r requirements-dev.in
 msgpack==1.1.2
     # via cachecontrol
 packageurl-python==0.17.6
@@ -94,11 +94,11 @@ packaging==25.0
 pip-api==0.0.34
     # via pip-audit
 pip-audit==2.10.0
-    # via -r lambdas/python/purchases/requirements-dev.in
+    # via -r requirements-dev.in
 pip-requirements-parser==32.0.1
     # via pip-audit
 pip-tools==7.5.2
-    # via -r lambdas/python/purchases/requirements-dev.in
+    # via -r requirements-dev.in
 platformdirs==4.5.1
     # via pip-audit
 pluggy==1.6.0
@@ -115,7 +115,7 @@ pygments==2.19.2
     # via
     #   pytest
     #   rich
-pyparsing==3.2.5
+pyparsing==3.3.1
     # via pip-requirements-parser
 pyproject-hooks==1.2.0
     # via
@@ -123,10 +123,10 @@ pyproject-hooks==1.2.0
     #   pip-tools
 pytest==9.0.2
     # via
-    #   -r lambdas/python/purchases/requirements-dev.in
+    #   -r requirements-dev.in
     #   pytest-cov
 pytest-cov==7.0.0
-    # via -r lambdas/python/purchases/requirements-dev.in
+    # via -r requirements-dev.in
 python-dateutil==2.9.0.post0
     # via
     #   botocore
@@ -137,7 +137,7 @@ pyyaml==6.0.3
     #   responses
 requests==2.32.5
     # via
-    #   -r lambdas/python/purchases/requirements-dev.in
+    #   -r requirements-dev.in
     #   cachecontrol
     #   docker
     #   moto
@@ -147,15 +147,15 @@ responses==0.25.8
     # via moto
 rich==14.2.0
     # via pip-audit
-ruff==0.14.9
-    # via -r lambdas/python/purchases/requirements-dev.in
+ruff==0.14.11
+    # via -r requirements-dev.in
 s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
 sortedcontainers==2.4.0
     # via cyclonedx-python-lib
-tomli==2.3.0
+tomli==2.4.0
     # via pip-audit
 tomli-w==1.2.0
     # via pip-audit
@@ -165,13 +165,14 @@ typing-extensions==4.15.0
     #   cyclonedx-python-lib
 tzdata==2025.3
     # via faker
-urllib3==2.6.2
+urllib3==2.6.3
     # via
+    #   -r requirements-dev.in
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 wheel==0.45.1
     # via pip-tools
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements.in b/backend/compact-connect/lambdas/python/purchases/requirements.in
index 3ddeb3993..f19cff7a1 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements.in
+++ b/backend/compact-connect/lambdas/python/purchases/requirements.in
@@ -1,4 +1,4 @@
 # common requirements are managed in the common-python requirements.in file
 authorizenet>=1.1.6, <2
 # explicitly setting this transitive dependency to pick vulnerability patch
-urllib3>=2.6.0, <3
+urllib3>=2.6.3, <3
diff --git a/backend/compact-connect/lambdas/python/purchases/requirements.txt b/backend/compact-connect/lambdas/python/purchases/requirements.txt
index 4bbd97e5b..0428304da 100644
--- a/backend/compact-connect/lambdas/python/purchases/requirements.txt
+++ b/backend/compact-connect/lambdas/python/purchases/requirements.txt
@@ -2,11 +2,11 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile requirements.in
+#    pip-compile --no-emit-index-url --no-strip-extras requirements.in
 #
 authorizenet==1.1.6
     # via -r requirements.in
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 charset-normalizer==3.4.4
     # via requests
@@ -18,5 +18,7 @@ pyxb-x==1.2.6.3
     # via authorizenet
 requests==2.32.5
     # via authorizenet
-urllib3==2.6.2
-    # via requests
+urllib3==2.6.3
+    # via
+    #   -r requirements.in
+    #   requests
diff --git a/backend/compact-connect/lambdas/python/search/requirements-dev.txt b/backend/compact-connect/lambdas/python/search/requirements-dev.txt
index 1d8dccf31..17607a54b 100644
--- a/backend/compact-connect/lambdas/python/search/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/search/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/search/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb]==5.1.18
+moto[dynamodb]==5.1.19
     # via -r lambdas/python/search/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -56,13 +56,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/search/requirements.txt b/backend/compact-connect/lambdas/python/search/requirements.txt
index 2352dd4f0..b196e5bfc 100644
--- a/backend/compact-connect/lambdas/python/search/requirements.txt
+++ b/backend/compact-connect/lambdas/python/search/requirements.txt
@@ -4,7 +4,7 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/search/requirements.in
 #
-certifi==2025.11.12
+certifi==2026.1.4
     # via
     #   opensearch-py
     #   requests
@@ -20,7 +20,7 @@ opensearch-protobufs==0.19.0
     # via opensearch-py
 opensearch-py==3.1.0
     # via -r lambdas/python/search/requirements.in
-protobuf==6.33.2
+protobuf==6.33.3
     # via opensearch-protobufs
 python-dateutil==2.9.0.post0
     # via opensearch-py
@@ -30,7 +30,7 @@ six==1.17.0
     # via python-dateutil
 typing-extensions==4.15.0
     # via grpcio
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   opensearch-py
     #   requests
diff --git a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
index b4c5e0e2c..9e5d9cfbd 100644
--- a/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-user-pre-token/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/staff-user-pre-token/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,7 +33,7 @@ markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[dynamodb,s3]==5.1.18
+moto[dynamodb,s3]==5.1.19
     # via -r lambdas/python/staff-user-pre-token/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -58,13 +58,13 @@ s3transfer==0.16.0
     # via boto3
 six==1.17.0
     # via python-dateutil
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
index 5d98ff0c5..11a650b0c 100644
--- a/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
+++ b/backend/compact-connect/lambdas/python/staff-users/requirements-dev.txt
@@ -4,14 +4,14 @@
 #
 #    pip-compile --no-emit-index-url --no-strip-extras lambdas/python/staff-users/requirements-dev.in
 #
-boto3==1.42.11
+boto3==1.42.25
     # via moto
-botocore==1.42.11
+botocore==1.42.25
     # via
     #   boto3
     #   moto
     #   s3transfer
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 cffi==2.0.0
     # via cryptography
@@ -33,13 +33,13 @@ jmespath==1.0.1
     # via
     #   boto3
     #   botocore
-joserfc==1.6.0
+joserfc==1.6.1
     # via moto
 markupsafe==3.0.3
     # via
     #   jinja2
     #   werkzeug
-moto[cognitoidp,dynamodb,s3]==5.1.18
+moto[cognitoidp,dynamodb,s3]==5.1.19
     # via -r lambdas/python/staff-users/requirements-dev.in
 py-partiql-parser==0.6.3
     # via moto
@@ -66,13 +66,13 @@ six==1.17.0
     # via python-dateutil
 tzdata==2025.3
     # via faker
-urllib3==2.6.2
+urllib3==2.6.3
     # via
     #   botocore
     #   docker
     #   requests
     #   responses
-werkzeug==3.1.4
+werkzeug==3.1.5
     # via moto
 xmltodict==1.0.2
     # via moto
diff --git a/backend/compact-connect/requirements-dev.txt b/backend/compact-connect/requirements-dev.txt
index c3230bdc7..75d66a79f 100644
--- a/backend/compact-connect/requirements-dev.txt
+++ b/backend/compact-connect/requirements-dev.txt
@@ -6,19 +6,19 @@
 #
 boolean-py==5.0
     # via license-expression
-build==1.3.0
+build==1.4.0
     # via pip-tools
 cachecontrol[filecache]==0.14.4
     # via
     #   cachecontrol
     #   pip-audit
-certifi==2025.11.12
+certifi==2026.1.4
     # via requests
 charset-normalizer==3.4.4
     # via requests
 click==8.3.1
     # via pip-tools
-coverage[toml]==7.13.0
+coverage[toml]==7.13.1
     # via
     #   -r requirements-dev.in
     #   pytest-cov
@@ -28,7 +28,7 @@ defusedxml==0.7.1
     # via py-serializable
 faker==37.12.0
     # via -r requirements-dev.in
-filelock==3.20.1
+filelock==3.20.3
     # via cachecontrol
 idna==3.11
     # via requests
@@ -70,7 +70,7 @@ pygments==2.19.2
     # via
     #   pytest
     #   rich
-pyparsing==3.2.5
+pyparsing==3.3.1
     # via pip-requirements-parser
 pyproject-hooks==1.2.0
     # via
@@ -88,17 +88,17 @@ requests==2.32.5
     #   pip-audit
 rich==14.2.0
     # via pip-audit
-ruff==0.14.9
+ruff==0.14.11
     # via -r requirements-dev.in
 sortedcontainers==2.4.0
     # via cyclonedx-python-lib
-tomli==2.3.0
+tomli==2.4.0
     # via pip-audit
 tomli-w==1.2.0
     # via pip-audit
 tzdata==2025.3
     # via faker
-urllib3==2.6.2
+urllib3==2.6.3
     # via requests
 wheel==0.45.1
     # via pip-tools
diff --git a/backend/compact-connect/requirements.txt b/backend/compact-connect/requirements.txt
index 070ada8b7..4c4f8ab00 100644
--- a/backend/compact-connect/requirements.txt
+++ b/backend/compact-connect/requirements.txt
@@ -8,15 +8,15 @@ attrs==25.4.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.242
+aws-cdk-asset-awscli-v1==2.2.258
     # via aws-cdk-lib
 aws-cdk-asset-node-proxy-agent-v6==2.1.0
     # via aws-cdk-lib
-aws-cdk-aws-lambda-python-alpha==2.232.2a0
+aws-cdk-aws-lambda-python-alpha==2.234.1a0
     # via -r requirements.in
 aws-cdk-cloud-assembly-schema==48.20.0
     # via aws-cdk-lib
-aws-cdk-lib==2.232.2
+aws-cdk-lib==2.234.1
     # via
     #   -r requirements.in
     #   aws-cdk-aws-lambda-python-alpha
@@ -33,7 +33,7 @@ constructs==10.4.4
     #   cdk-nag
 importlib-resources==6.5.2
     # via jsii
-jsii==1.121.0
+jsii==1.125.0
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-node-proxy-agent-v6
diff --git a/backend/compact-connect/stacks/persistent_stack/__init__.py b/backend/compact-connect/stacks/persistent_stack/__init__.py
index 4909c69bd..43992a3fa 100644
--- a/backend/compact-connect/stacks/persistent_stack/__init__.py
+++ b/backend/compact-connect/stacks/persistent_stack/__init__.py
@@ -491,7 +491,11 @@ def _create_frontend_app_config_parameter(self):
         )
 
         # Add UI and API domain names
-        frontend_app_config.set_domain_names(ui_domain_name=self.ui_domain_name, api_domain_name=self.api_domain_name)
+        frontend_app_config.set_domain_names(
+            ui_domain_name=self.ui_domain_name,
+            api_domain_name=self.api_domain_name,
+            search_api_domain_name=self.search_api_domain_name,
+        )
 
         # Add bucket names needed for CSP Lambda
         frontend_app_config.set_license_bulk_uploads_bucket_name(bucket_name=self.bulk_uploads_bucket.bucket_name)
diff --git a/backend/compact-connect/tests/app/test_frontend_app_config.py b/backend/compact-connect/tests/app/test_frontend_app_config.py
index f25d6b4a9..7f94c4ab3 100644
--- a/backend/compact-connect/tests/app/test_frontend_app_config.py
+++ b/backend/compact-connect/tests/app/test_frontend_app_config.py
@@ -19,7 +19,11 @@ def test_setters_set_expected_fields(self):
 
         # Set values
         util.set_staff_cognito_values(domain_name='staff-domain.example.com', client_id='staff-client-123')
-        util.set_domain_names(ui_domain_name='ui.example.com', api_domain_name='api.example.com')
+        util.set_domain_names(
+            ui_domain_name='ui.example.com',
+            api_domain_name='api.example.com',
+            search_api_domain_name='search.example.com',
+        )
 
         # Get JSON representation
         config_json = util.get_config_json()
@@ -32,6 +36,7 @@ def test_setters_set_expected_fields(self):
                 'staff_cognito_client_id': 'staff-client-123',
                 'ui_domain_name': 'ui.example.com',
                 'api_domain_name': 'api.example.com',
+                'search_api_domain_name': 'search.example.com',
             },
             config_dict,
         )
@@ -46,6 +51,7 @@ def test_getters_return_expected_values(self):
                     'staff_cognito_client_id': 'staff-client-123',
                     'ui_domain_name': 'ui.example.com',
                     'api_domain_name': 'api.example.com',
+                    'search_api_domain_name': 'search.example.com',
                 }
             )
         )
@@ -55,6 +61,7 @@ def test_getters_return_expected_values(self):
         self.assertEqual(util.staff_cognito_client_id, 'staff-client-123')
         self.assertEqual(util.ui_domain_name, 'ui.example.com')
         self.assertEqual(util.api_domain_name, 'api.example.com')
+        self.assertEqual(util.search_api_domain_name, 'search.example.com')
 
 
 class TestProviderUserStackFrontendAppConfigUtility(TestCase):