diff --git a/README.md b/README.md
index 7615b9c..f7974ee 100644
--- a/README.md
+++ b/README.md
@@ -14,13 +14,13 @@ Copy this into your coding agent (Claude Code, Codex, Cursor, Gemini CLI, …) a
 Prefer to do it yourself? See [**Install per harness**](#install-per-harness) below.
 On a supported harness, use the plugin installer (reviewed pin + lock, `npm ci --ignore-scripts`).
 The no-plugin fallback is the **pinned** CLI in [guides/generic.md](guides/generic.md)
-(`@selat-ai/selat-cli@0.17.2 --ignore-scripts` — not `@latest`). Agents: the step-by-step
+(`@selat-ai/selat-cli@0.17.3 --ignore-scripts` — not `@latest`). Agents: the step-by-step
 runbook is [**install.md**](install.md).
 
 > **Marketplace repo: [`SELAT-AI/selat-plugins`](https://github.com/SELAT-AI/selat-plugins)** —
 > the third SELAT distribution surface (after the npm package and the published skill).
 > Prefer the plugin install below (reviewed pin + lock). The no-plugin fallback is
-> [guides/generic.md](guides/generic.md): `npm i -g @selat-ai/selat-cli@0.17.2 --ignore-scripts`
+> [guides/generic.md](guides/generic.md): `npm i -g @selat-ai/selat-cli@0.17.3 --ignore-scripts`
 > then `selat init`. Do not install `@latest` as the payment path.
 
 ## What this is
@@ -80,7 +80,7 @@ auto-approved; anything that spends or moves money (`selat run`, `selat skill ru
 | Gemini CLI | [guides/gemini-cli.md](guides/gemini-cli.md) | `gemini extensions install https://github.com/SELAT-AI/selat-plugins` (no spend hook, no locked runner; `--auto-update` is not the default) |
 | OpenClaw | [guides/openclaw.md](guides/openclaw.md) | `openclaw plugins install selat --marketplace https://github.com/SELAT-AI/selat-plugins` (bundle auto-detect) |
 | Hermes | [guides/hermes.md](guides/hermes.md) | `hermes plugins install SELAT-AI/selat-plugins/plugins/selat-hermes --enable` — the subdirectory path is required (the bare repo form buries the plugin at `plugins/selat-plugins/plugins/selat-hermes/`; see the guide). The plugin vendors the pin + lock and installs the reviewed runner |
-| Any other / none | [guides/generic.md](guides/generic.md) | `npm i -g @selat-ai/selat-cli@0.17.2 --ignore-scripts` then `selat init` (not `@latest`) |
+| Any other / none | [guides/generic.md](guides/generic.md) | `npm i -g @selat-ai/selat-cli@0.17.3 --ignore-scripts` then `selat init` (not `@latest`) |
 
 After install, every harness runs the same first-time setup (self-custody):
 
diff --git a/guides/gemini-cli.md b/guides/gemini-cli.md
index 9a2a096..f9d8007 100644
--- a/guides/gemini-cli.md
+++ b/guides/gemini-cli.md
@@ -36,7 +36,7 @@ The Gemini variant differs from the Claude/Codex plugin:
 SELAT pays from **your own Circle Agent Wallet** (MPC self-custody) — it never holds
 your keys or funds, and never creates a wallet for you. Gemini does not install the
 locked runner. If `selat` is not already the reviewed plugin prefix, install the pinned
-CLI from [generic.md](generic.md) (`@selat-ai/selat-cli@0.17.2 --ignore-scripts` — not
+CLI from [generic.md](generic.md) (`@selat-ai/selat-cli@0.17.3 --ignore-scripts` — not
 `@latest`). Then run onboarding yourself:
 
 ```bash
diff --git a/guides/generic.md b/guides/generic.md
index 28c1bdf..da59528 100644
--- a/guides/generic.md
+++ b/guides/generic.md
@@ -11,7 +11,7 @@ Install the **pinned** CLI (the same version the plugin lock reviews). Do **not*
 `@latest` as a payment runner:
 
 ```bash
-npm i -g @selat-ai/selat-cli@0.17.2 --ignore-scripts
+npm i -g @selat-ai/selat-cli@0.17.3 --ignore-scripts
 ```
 
 The exact pin lives in `plugins/selat/hooks-handlers/selat-cli.version`. If that file
diff --git a/install.md b/install.md
index fed71ff..619178c 100644
--- a/install.md
+++ b/install.md
@@ -110,7 +110,7 @@ Prefer a plugin install above when your harness supports one — that path uses
 reviewed pin + lock and `npm ci --ignore-scripts`. If there is no plugin, install the
 **pinned** CLI (not `@latest`):
 ```bash
-npm i -g @selat-ai/selat-cli@0.17.2 --ignore-scripts
+npm i -g @selat-ai/selat-cli@0.17.3 --ignore-scripts
 ```
 The exact pin is `plugins/selat/hooks-handlers/selat-cli.version`. See
 [guides/generic.md](guides/generic.md).
diff --git a/plugins/selat-hermes/selat-cli.version b/plugins/selat-hermes/selat-cli.version
index 73da8ef..c73fb12 100644
--- a/plugins/selat-hermes/selat-cli.version
+++ b/plugins/selat-hermes/selat-cli.version
@@ -3,4 +3,4 @@
 # automation bumps THIS file after vetting a release, so what installs is exactly
 # what was reviewed (never a floating `latest`). SELAT_CLI_SPEC overrides it.
 # Format: one bare semver on its own line; lines starting with # are comments.
-0.17.2
\ No newline at end of file
+0.17.3
\ No newline at end of file
diff --git a/plugins/selat-hermes/selat-runtime-package-lock.json b/plugins/selat-hermes/selat-runtime-package-lock.json
index 0dc8046..49b2d45 100644
--- a/plugins/selat-hermes/selat-runtime-package-lock.json
+++ b/plugins/selat-hermes/selat-runtime-package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "@selat-ai/plugin-runtime-lock",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@selat-ai/plugin-runtime-lock",
-      "version": "0.17.2",
+      "version": "0.17.3",
       "dependencies": {
-        "@selat-ai/selat-cli": "0.17.2",
+        "@selat-ai/selat-cli": "0.17.3",
         "@selat-ai/selat-discovery": "0.25.1",
         "@selat-ai/selat-pay": "0.11.2"
       }
@@ -132,13 +132,13 @@
       }
     },
     "node_modules/@selat-ai/selat-cli": {
-      "version": "0.17.2",
-      "resolved": "https://registry.npmjs.org/@selat-ai/selat-cli/-/selat-cli-0.17.2.tgz",
-      "integrity": "sha512-6HnK6yQSRaywvkkpYFxrPheKM+PV0t4YY5EpW6DKTlMla2An9AiUDLtDsbwmctJqjgw/H13U8VdjaYqiEvBCkg==",
+      "version": "0.17.3",
+      "resolved": "https://registry.npmjs.org/@selat-ai/selat-cli/-/selat-cli-0.17.3.tgz",
+      "integrity": "sha512-ZL2OA5NOR9qYaAvaDOn2lI57X4BqvmB5QYPq8tgN40CvkdMt1PvDUaaPL2ZfKhARNnzF+xzAaVTnUrMwh1uHOQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@selat-ai/selat-discovery": "^0.25.0",
-        "@selat-ai/selat-pay": "^0.11.0",
+        "@selat-ai/selat-pay": "^0.11.2",
         "qrcode-generator": "2.0.4"
       },
       "bin": {
diff --git a/plugins/selat-hermes/selat-runtime-package.json b/plugins/selat-hermes/selat-runtime-package.json
index ad1de2f..545f843 100644
--- a/plugins/selat-hermes/selat-runtime-package.json
+++ b/plugins/selat-hermes/selat-runtime-package.json
@@ -1,10 +1,10 @@
 {
   "name": "@selat-ai/plugin-runtime-lock",
   "private": true,
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Locked SELAT plugin runtime closure; update only through the coordinated SELAT release process.",
   "dependencies": {
-    "@selat-ai/selat-cli": "0.17.2",
+    "@selat-ai/selat-cli": "0.17.3",
     "@selat-ai/selat-discovery": "0.25.1",
     "@selat-ai/selat-pay": "0.11.2"
   },
diff --git a/plugins/selat/hooks-handlers/selat-cli.version b/plugins/selat/hooks-handlers/selat-cli.version
index 73da8ef..c73fb12 100644
--- a/plugins/selat/hooks-handlers/selat-cli.version
+++ b/plugins/selat/hooks-handlers/selat-cli.version
@@ -3,4 +3,4 @@
 # automation bumps THIS file after vetting a release, so what installs is exactly
 # what was reviewed (never a floating `latest`). SELAT_CLI_SPEC overrides it.
 # Format: one bare semver on its own line; lines starting with # are comments.
-0.17.2
\ No newline at end of file
+0.17.3
\ No newline at end of file
diff --git a/plugins/selat/hooks-handlers/selat-runtime-package-lock.json b/plugins/selat/hooks-handlers/selat-runtime-package-lock.json
index 0dc8046..49b2d45 100644
--- a/plugins/selat/hooks-handlers/selat-runtime-package-lock.json
+++ b/plugins/selat/hooks-handlers/selat-runtime-package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "@selat-ai/plugin-runtime-lock",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@selat-ai/plugin-runtime-lock",
-      "version": "0.17.2",
+      "version": "0.17.3",
       "dependencies": {
-        "@selat-ai/selat-cli": "0.17.2",
+        "@selat-ai/selat-cli": "0.17.3",
         "@selat-ai/selat-discovery": "0.25.1",
         "@selat-ai/selat-pay": "0.11.2"
       }
@@ -132,13 +132,13 @@
       }
     },
     "node_modules/@selat-ai/selat-cli": {
-      "version": "0.17.2",
-      "resolved": "https://registry.npmjs.org/@selat-ai/selat-cli/-/selat-cli-0.17.2.tgz",
-      "integrity": "sha512-6HnK6yQSRaywvkkpYFxrPheKM+PV0t4YY5EpW6DKTlMla2An9AiUDLtDsbwmctJqjgw/H13U8VdjaYqiEvBCkg==",
+      "version": "0.17.3",
+      "resolved": "https://registry.npmjs.org/@selat-ai/selat-cli/-/selat-cli-0.17.3.tgz",
+      "integrity": "sha512-ZL2OA5NOR9qYaAvaDOn2lI57X4BqvmB5QYPq8tgN40CvkdMt1PvDUaaPL2ZfKhARNnzF+xzAaVTnUrMwh1uHOQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@selat-ai/selat-discovery": "^0.25.0",
-        "@selat-ai/selat-pay": "^0.11.0",
+        "@selat-ai/selat-pay": "^0.11.2",
         "qrcode-generator": "2.0.4"
       },
       "bin": {
diff --git a/plugins/selat/hooks-handlers/selat-runtime-package.json b/plugins/selat/hooks-handlers/selat-runtime-package.json
index ad1de2f..545f843 100644
--- a/plugins/selat/hooks-handlers/selat-runtime-package.json
+++ b/plugins/selat/hooks-handlers/selat-runtime-package.json
@@ -1,10 +1,10 @@
 {
   "name": "@selat-ai/plugin-runtime-lock",
   "private": true,
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Locked SELAT plugin runtime closure; update only through the coordinated SELAT release process.",
   "dependencies": {
-    "@selat-ai/selat-cli": "0.17.2",
+    "@selat-ai/selat-cli": "0.17.3",
     "@selat-ai/selat-discovery": "0.25.1",
     "@selat-ai/selat-pay": "0.11.2"
   },