A city devops group wants reproducible Claude client behavior across deploys. What dependency practice fits?

City devops groups that want reproducible Claude client behavior across deploys should pin Claude SDK versions in lockfiles. Dependency pinning fits because floating versions let pods resolve different SDK builds over time, producing inconsistent request shaping, bugfixes, or breaking changes across municipal environments. Lockfiles make deploys reproducible, support audited upgrades, and keep incident analysis tied to a known client version. Scheduling automated minor SDK bumps with tests fails by concept: even automated minor bumps still float the version out from under a tested lockfile and can change client behavior across deploys unless the resolved version is pinned and reviewed. Constraining SDK versions to a major.minor range while allowing patch updates automatically fails by concept: even patch releases can change behavior, so auto-applying them still breaks the reproducibility a pinned lockfile guarantees. Caching Claude SDK downloads in CI layers fails by concept: caching speeds up installs but does not pin the SDK version, so different deploys can still resolve different builds and break reproducibility. Exam caveat: pinning is not a substitute for scheduled upgrades—cities should still patch SDKs on a controlled cadence after testing—and lockfiles must be committed and used in CI identically to production. Operational check: commit the Claude SDK version in the city service lockfile, build two deploy artifacts on different days, confirm both resolve the same SDK hash, then perform a deliberate version bump through PR review with regression tests before promoting.