diff --git a/forgetest/forgetest/coverage.py b/forgetest/forgetest/coverage.py
index 367272d..c7f34c9 100644
--- a/forgetest/forgetest/coverage.py
+++ b/forgetest/forgetest/coverage.py
@@ -32,7 +32,10 @@ ALLOW = [
     ("*", "tests/**"),
     ("*", "graphify-out/**"),
     ("*", "**/.gitkeep"),
-    ("forgectrl", "tools/**"),        # the host-side mock, no target behavior
+    ("*", ".devcontainer/**"),        # editor/dev-environment setup, no target
+    ("*", ".vscode/**"),              #   behavior
+    ("*", ".env.example"),
+    ("forgectrl", "tools/**"),        # host-side dev tools (panel dev server)
 ]
 
 
diff --git a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl-pin.inc b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl-pin.inc
index 276a646..8da250f 100644
--- a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl-pin.inc
+++ b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl-pin.inc
@@ -2,5 +2,5 @@
 # only SRCREV and PV here - the image manifest leaves *-pin.inc out of the
 # layer content hash because the component entry already identifies the
 # pinned source (forgefirm-image-manifest.bbclass).
-SRCREV = "c8f655813ba2b9a44fdf032e84435d9454909d7c"
+SRCREV = "5af4fb599e00bea9d116b23ad0c5a016b9ef6f5b"
 PV = "0.1.0"