diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..990d4b0
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,10 @@
+# Shell scripts must stay LF; CRLF breaks shebangs under WSL/Linux
+# (bad interpreter: /bin/bash^M).
+*.sh text eol=lf
+
+# Extensionless customer-facing scripts published to this example repo
+init text eol=lf
+check-prereqs text eol=lf
+available-connectors text eol=lf
+az-auth text eol=lf
+preflight text eol=lf
diff --git a/google-workspace.tf b/google-workspace.tf
index e35fb2f..5e0b254 100644
--- a/google-workspace.tf
+++ b/google-workspace.tf
@@ -7,7 +7,7 @@ provider "google" {
 
 
 module "worklytics_connectors_google_workspace" {
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors-google-workspace?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors-google-workspace?ref=v0.6.8"
 
   google_workspace_connector_settings = var.google_workspace_connector_settings
 
diff --git a/main.tf b/main.tf
index 32e1773..13271d4 100644
--- a/main.tf
+++ b/main.tf
@@ -20,7 +20,7 @@ terraform {
 
 # general cases
 module "worklytics_connectors" {
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors?ref=v0.6.8"
 
   enabled_connectors                       = var.enabled_connectors
   connector_settings                       = var.connector_settings
@@ -119,7 +119,7 @@ locals {
 }
 
 module "psoxy" {
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-host?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-host?ref=v0.6.8"
 
   environment_name                     = var.environment_name
   aws_account_id                       = var.aws_account_id
@@ -197,7 +197,7 @@ locals {
 module "connection_in_worklytics" {
   for_each = local.all_instances
 
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-proxy-connection-aws?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-proxy-connection-aws?ref=v0.6.8"
 
   proxy_instance_id    = each.key
   worklytics_host      = var.worklytics_host
diff --git a/msft-365.tf b/msft-365.tf
index c37d574..8d72f0b 100644
--- a/msft-365.tf
+++ b/msft-365.tf
@@ -1,7 +1,7 @@
 # BEGIN MSFT
 
 module "worklytics_connectors_msft_365" {
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors-msft-365?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/worklytics-connectors-msft-365?ref=v0.6.8"
 
   msft_365_connector_settings = var.msft_365_connector_settings
 
@@ -50,7 +50,7 @@ data "aws_region" "current" {
 module "cognito_identity_pool" {
   count = local.msft_365_enabled ? 1 : 0 # only provision identity pool if MSFT-365 connectors are enabled
 
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-cognito-pool?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-cognito-pool?ref=v0.6.8"
 
   developer_provider_name = local.developer_provider_name
   name                    = "${local.env_qualifier}-azure-ad-federation"
@@ -72,7 +72,7 @@ locals {
 module "cognito_identity" {
   count = local.msft_365_enabled ? 1 : 0 # only provision identity pool if MSFT-365 connectors are enabled
 
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-cognito-identity-cli?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/aws-cognito-identity-cli?ref=v0.6.8"
 
 
   aws_region       = data.aws_region.current.region
@@ -109,7 +109,7 @@ locals {
 module "msft_connection_auth_federation" {
   for_each = local.provision_entraid_apps ? local.enabled_to_entraid_object : local.shared_to_entraid_object
 
-  source = "git::https://github.com/worklytics/psoxy//infra/modules/azuread-federated-credentials?ref=v0.6.7"
+  source = "git::https://github.com/worklytics/psoxy//infra/modules/azuread-federated-credentials?ref=v0.6.8"
 
   application_id = each.value.connector_id
   display_name   = "${local.env_qualifier}AccessFromAWS"