diff --git a/README.md b/README.md
index 7b86bb5..5271895 100644
--- a/README.md
+++ b/README.md
@@ -68,11 +68,16 @@ Copy `.cinc/config.rb.example` to `.cinc/config.rb` and adjust
 
 ### Update Cinc Client on a server
 
-    knife zero converge name:dev.kosmos.org --client-version 18.2.7
+    knife zero converge name:dev.kosmos.org --client-version latest
 
 ### Upgrade Cinc Client on a node
 
-    knife ssh -a knife_zero.host 'name:foo-1' 'curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -v 19'
+    knife ssh -a knife_zero.host 'name:foo-1' 'curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -v latest'
+
+The migration script (below) installs the **current stable** Cinc Client for the
+node's platform (`-v latest`); omnitruck picks the right build per OS. Pass a
+concrete version (e.g. `-v 19.2.12`) instead of `latest` if you need a true
+freeze.
 
 ### Migrate an existing node to Cinc Client
 
diff --git a/scripts/knife/migrate_node_to_cinc.sh b/scripts/knife/migrate_node_to_cinc.sh
index d6333ef..7b2d75f 100755
--- a/scripts/knife/migrate_node_to_cinc.sh
+++ b/scripts/knife/migrate_node_to_cinc.sh
@@ -8,7 +8,8 @@
 # Idempotent and safe to re-run. Run from the chef repo (uses .cinc/config.rb).
 #
 # What it does on the node (as root, over knife's own SSH connection):
-#   1. installs Cinc Client if the node still runs Chef Infra Client
+#   1. installs the current stable Cinc Client if the node still runs Chef
+#      Infra Client (omnitruck resolves the right build for the platform)
 #   2. makes /etc/cinc resolve to the existing knife-zero config in /etc/chef
 #   3. drops the deprecated attribute whitelist/blacklist lines from client.rb
 #   4. pre-seeds /etc/cinc/client.d/attributes.rb (the allowed_* lists) so the
@@ -41,10 +42,13 @@ remote="$(mktemp)"; trap 'rm -f "$remote"' EXIT
 cat >"$remote" <<EOF
 set -euo pipefail
 
-# 1. Cinc Client (Chef -> Cinc migration, or fresh)
+# 1. Cinc Client (Chef -> Cinc migration, or fresh).
+#    Install the current stable release for this platform. omnitruck resolves the
+#    right build per OS (so 20.04 and 22.04+ each get their latest supported
+#    version), and passing -v also suppresses the "without a version pin" warning.
 if ! command -v cinc-client >/dev/null 2>&1 && [ ! -x /opt/cinc/bin/cinc-client ]; then
-  echo ">> installing Cinc Client"
-  curl -sL https://omnitruck.cinc.sh/install.sh | bash
+  echo ">> installing the current stable Cinc Client"
+  curl -sL https://omnitruck.cinc.sh/install.sh | bash -s -- -v latest
 fi
 
 # 2. Point /etc/cinc at the existing knife-zero config in /etc/chef
diff --git a/site-cookbooks/deno b/site-cookbooks/deno
index 3795c9e..c78bc66 160000
--- a/site-cookbooks/deno
+++ b/site-cookbooks/deno
@@ -1 +1 @@
-Subproject commit 3795c9e67247ce7f29187656aff460d75cff64da
+Subproject commit c78bc669120de69191327785fce776faf3ca1651
diff --git a/site-cookbooks/kosmos-ejabberd/kitchen.yml b/site-cookbooks/kosmos-ejabberd/kitchen.yml
index af198f0..42657ef 100644
--- a/site-cookbooks/kosmos-ejabberd/kitchen.yml
+++ b/site-cookbooks/kosmos-ejabberd/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   pull_platform_image: false
   pull_chef_image: false
   memory_limit: 2147483648 # 2GB
diff --git a/site-cookbooks/kosmos_email/kitchen.yml b/site-cookbooks/kosmos_email/kitchen.yml
index 1b3ef2a..c7c410b 100644
--- a/site-cookbooks/kosmos_email/kitchen.yml
+++ b/site-cookbooks/kosmos_email/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   pull_platform_image: false
   pull_chef_image: false
   memory_limit: 2147483648 # 2GB
diff --git a/site-cookbooks/kosmos_garage/kitchen.yml b/site-cookbooks/kosmos_garage/kitchen.yml
index 104b2f1..55dad06 100644
--- a/site-cookbooks/kosmos_garage/kitchen.yml
+++ b/site-cookbooks/kosmos_garage/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   pull_platform_image: false
   pull_chef_image: false
   memory_limit: 2147483648 # 2GB
diff --git a/site-cookbooks/kosmos_liquor-cabinet/kitchen.yml b/site-cookbooks/kosmos_liquor-cabinet/kitchen.yml
index a4db9af..1a5e604 100644
--- a/site-cookbooks/kosmos_liquor-cabinet/kitchen.yml
+++ b/site-cookbooks/kosmos_liquor-cabinet/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   privileged: true  # allows systemd services to start
 
 provisioner:
diff --git a/site-cookbooks/kosmos_rsk/kitchen.yml b/site-cookbooks/kosmos_rsk/kitchen.yml
index b915cd8..0269395 100644
--- a/site-cookbooks/kosmos_rsk/kitchen.yml
+++ b/site-cookbooks/kosmos_rsk/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   pull_platform_image: false
   pull_chef_image: false
   memory_limit: 2147483648 # 2GB
diff --git a/site-cookbooks/liquor_cabinet/kitchen.yml b/site-cookbooks/liquor_cabinet/kitchen.yml
index db82d23..048eefd 100644
--- a/site-cookbooks/liquor_cabinet/kitchen.yml
+++ b/site-cookbooks/liquor_cabinet/kitchen.yml
@@ -1,7 +1,6 @@
 ---
 driver:
   name: dokken
-  chef_version: 18.2.7
   privileged: true  # allows systemd services to start
 
 provisioner:
diff --git a/site-cookbooks/strfry b/site-cookbooks/strfry
index 9c04b39..8107b1e 160000
--- a/site-cookbooks/strfry
+++ b/site-cookbooks/strfry
@@ -1 +1 @@
-Subproject commit 9c04b393ec69588eebce036df406372d9faa3f59
+Subproject commit 8107b1e05d2d6966407593c95e4a7ae454b2ee79