diff --git a/pyproject.toml b/pyproject.toml
index 9572f16..32b5692 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "gds-idea-app-kit"
-version = "0.2.3"
+version = "0.2.4"
 description = "CLI tool for scaffolding and maintaining GDS IDEA web apps on AWS"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/gds_idea_app_kit/init.py b/src/gds_idea_app_kit/init.py
index d5881d1..c785c43 100644
--- a/src/gds_idea_app_kit/init.py
+++ b/src/gds_idea_app_kit/init.py
@@ -284,6 +284,12 @@ def run_init(framework: str, app_name: str, python_version: str) -> None:
         project_dir / ".github" / "workflows" / "ci_cd_cdk_app.yml",
     )
 
+    # -- Copy CI (PR) workflow --
+    _copy_template(
+        templates / "common" / "ci_pr_cdk_app.yml",
+        project_dir / ".github" / "workflows" / "ci_pr_cdk_app.yml",
+    )
+
     # -- Copy .devcontainer/ files --
     _copy_template(
         templates / "common" / "devcontainer.json",
diff --git a/src/gds_idea_app_kit/manifest.py b/src/gds_idea_app_kit/manifest.py
index 106bb63..20bc08d 100644
--- a/src/gds_idea_app_kit/manifest.py
+++ b/src/gds_idea_app_kit/manifest.py
@@ -17,6 +17,7 @@
 # The dict maps template source path -> destination path in the project.
 TOOL_OWNED_FILES = {
     "common/ci_cd_cdk_app.yml": ".github/workflows/ci_cd_cdk_app.yml",
+    "common/ci_pr_cdk_app.yml": ".github/workflows/ci_pr_cdk_app.yml",
     "common/devcontainer.json": ".devcontainer/devcontainer.json",
     "common/docker-compose.yml": ".devcontainer/docker-compose.yml",
     "dev_mocks/dev_mock_authoriser.json": "dev_mocks/dev_mock_authoriser.json",
diff --git a/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml b/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml
index 31c870e..0f8c95f 100644
--- a/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml
+++ b/src/gds_idea_app_kit/templates/common/ci_cd_cdk_app.yml
@@ -12,10 +12,6 @@ permissions:
   pull-requests: write
   
 jobs:
-  ci_pr_dev:
-    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_pr_dev.yml@main
-    with:
-      run-version-check: false
       
   ci_build:
     uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_build.yml@main
@@ -43,5 +39,5 @@ jobs:
       run-version-check: false
 
   cd:
-    needs: [ci_pr_dev, ci_build, ci_pyproject_version, ci_lint, ci_tests, ci_cdk_diff]
+    needs: [ci_build, ci_pyproject_version, ci_lint, ci_tests, ci_cdk_diff]
     uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/cd_workflow_cdk.yml@main
diff --git a/src/gds_idea_app_kit/templates/common/ci_pr_cdk_app.yml b/src/gds_idea_app_kit/templates/common/ci_pr_cdk_app.yml
new file mode 100644
index 0000000..8f2082f
--- /dev/null
+++ b/src/gds_idea_app_kit/templates/common/ci_pr_cdk_app.yml
@@ -0,0 +1,44 @@
+name: CI (PR) Orchestrator for CDK Apps
+
+on:
+  pull_request:
+    branches: 
+      - prod
+      - dev
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+jobs:
+  ci_pr_dev:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_pr_dev.yml@main
+    with:
+      run-version-check: false
+      
+  ci_build:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_build.yml@main
+    with:
+      run-version-check: false
+
+  ci_pyproject_version:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_pyproject_version.yml@main
+    with:
+      run-version-check: false
+
+  ci_lint:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_lint.yml@main
+    with:
+      run-version-check: false
+
+  ci_tests:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_tests.yml@main
+    with:
+      run-version-check: false
+
+  ci_cdk_diff:
+    uses: co-cddo/gds-idea-workflows-catalogue/.github/workflows/ci_cdk_diff.yml@main
+    with:
+      run-version-check: false
+    secrets: inherit 
\ No newline at end of file
diff --git a/src/gds_idea_app_kit/templates/common/docker-compose.yml b/src/gds_idea_app_kit/templates/common/docker-compose.yml
index 9587f80..b942da5 100644
--- a/src/gds_idea_app_kit/templates/common/docker-compose.yml
+++ b/src/gds_idea_app_kit/templates/common/docker-compose.yml
@@ -21,6 +21,9 @@ services:
       # Mount app source for live editing and auto-reload
       - ../app_src:/app
 
+      # Preserve container's .venv (prevents host .venv overwriting it)
+      - /app/.venv
+
       # Mount dev mock files directory (can be empty)
       - ../dev_mocks:/app/dev_mocks
 
diff --git a/src/gds_idea_app_kit/templates/dash/dash_app.py b/src/gds_idea_app_kit/templates/dash/dash_app.py
index 81f615d..65b4f41 100644
--- a/src/gds_idea_app_kit/templates/dash/dash_app.py
+++ b/src/gds_idea_app_kit/templates/dash/dash_app.py
@@ -20,8 +20,6 @@
 # Your app logger
 logger = logging.getLogger(__name__)
 
-REDIRECT_URL = "https://gds-idea.click/401.html"
-
 app = Dash(__name__)
 
 
diff --git a/src/gds_idea_app_kit/templates/dash/pyproject.toml.template b/src/gds_idea_app_kit/templates/dash/pyproject.toml.template
index 98cfccc..220b686 100644
--- a/src/gds_idea_app_kit/templates/dash/pyproject.toml.template
+++ b/src/gds_idea_app_kit/templates/dash/pyproject.toml.template
@@ -1,11 +1,11 @@
 [project]
 name = "{{app_name}}"
-version = "0.1.0"
+version = "0.0.0"  # Version managed in root pyproject.toml
 description = "Dash app with Cognito authentication"
 requires-python = ">={{python_version}}"
 dependencies = [
     "cognito-auth[dash] @ git+https://github.com/co-cddo/gds-idea-app-auth.git",
-    "gunicorn>=21.0.0",
+    "gunicorn>=25.1.0",
 ]
 
 [tool.ruff]
diff --git a/src/gds_idea_app_kit/templates/fastapi/pyproject.toml.template b/src/gds_idea_app_kit/templates/fastapi/pyproject.toml.template
index 02e47a0..d1234f7 100644
--- a/src/gds_idea_app_kit/templates/fastapi/pyproject.toml.template
+++ b/src/gds_idea_app_kit/templates/fastapi/pyproject.toml.template
@@ -1,6 +1,6 @@
 [project]
 name = "{{app_name}}"
-version = "0.1.0"
+version = "0.0.0"  # Version managed in root pyproject.toml
 description = "FastAPI app with Cognito authentication"
 requires-python = ">={{python_version}}"
 dependencies = [
diff --git a/src/gds_idea_app_kit/templates/streamlit/pyproject.toml.template b/src/gds_idea_app_kit/templates/streamlit/pyproject.toml.template
index 83234b8..3979ea0 100644
--- a/src/gds_idea_app_kit/templates/streamlit/pyproject.toml.template
+++ b/src/gds_idea_app_kit/templates/streamlit/pyproject.toml.template
@@ -1,6 +1,6 @@
 [project]
 name = "{{app_name}}"
-version = "0.1.0"
+version = "0.0.0"  # Version managed in root pyproject.toml
 description = "Streamlit app with Cognito authentication"
 requires-python = ">={{python_version}}"
 dependencies = [
diff --git a/src/gds_idea_app_kit/templates/streamlit/streamlit_app.py b/src/gds_idea_app_kit/templates/streamlit/streamlit_app.py
index d12380d..8044764 100644
--- a/src/gds_idea_app_kit/templates/streamlit/streamlit_app.py
+++ b/src/gds_idea_app_kit/templates/streamlit/streamlit_app.py
@@ -17,8 +17,6 @@
 # Your app logger
 logger = logging.getLogger(__name__)
 
-REDIRECT_URL = "https://gds-idea.click/401.html"
-
 auth = StreamlitAuth()
 
 user = auth.get_auth_user()
diff --git a/tests/test_manifest.py b/tests/test_manifest.py
index 67ad376..91b37d9 100644
--- a/tests/test_manifest.py
+++ b/tests/test_manifest.py
@@ -33,6 +33,7 @@ def tracked_project(project_dir):
     (project_dir / ".devcontainer" / "docker-compose.yml").write_text("services:")
     (project_dir / ".github" / "workflows").mkdir(parents=True)
     (project_dir / ".github" / "workflows" / "ci_cd_cdk_app.yml").write_text("name: CI/CD")
+    (project_dir / ".github" / "workflows" / "ci_pr_cdk_app.yml").write_text("name: CI PR")
     (project_dir / "dev_mocks").mkdir()
     (project_dir / "dev_mocks" / "dev_mock_authoriser.json").write_text("{}")
     (project_dir / "dev_mocks" / "dev_mock_user.json").write_text("{}")
@@ -87,6 +88,7 @@ def test_tracked_files_include_common_destinations(framework):
     tracked = get_tracked_files(framework)
     destinations = set(tracked.values())
     assert ".github/workflows/ci_cd_cdk_app.yml" in destinations
+    assert ".github/workflows/ci_pr_cdk_app.yml" in destinations
     assert ".devcontainer/devcontainer.json" in destinations
     assert ".devcontainer/docker-compose.yml" in destinations
     assert "dev_mocks/dev_mock_authoriser.json" in destinations
@@ -177,7 +179,7 @@ def test_build_manifest_hashes_all_tracked_files(tracked_project):
     assert result["framework"] == "streamlit"
     assert result["app_name"] == "test-app"
     assert result["tool_version"] == "0.1.0"
-    assert len(result["files"]) == 6
+    assert len(result["files"]) == 7
     for file_hash in result["files"].values():
         assert file_hash.startswith("sha256:")
 
diff --git a/uv.lock b/uv.lock
index 869dca7..40b7873 100644
--- a/uv.lock
+++ b/uv.lock
@@ -52,7 +52,7 @@ wheels = [
 
 [[package]]
 name = "gds-idea-app-kit"
-version = "0.2.3"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },