diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 940ed98..dcac61e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,12 +1,14 @@
 name: deploy to lambda
-on: [push]
+on:
+  push:
+    branches: [master]
 jobs:
   deploy_zip:
     name: deploy lambda function from zip
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ["1.22"]
+        go-version: ["1.26"]
     steps:
       - name: checkout source code
         uses: actions/checkout@v7
diff --git a/Dockerfile b/Dockerfile
index 9894c11..6b4898e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/appleboy/drone-lambda:1.3.9
+FROM ghcr.io/appleboy/drone-lambda@sha256:07cf67c4c0b647f2f79e444db446d88d332a8a0b0d3aaf8753692e6f7792a7cf
 
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
diff --git a/README.md b/README.md
index 1e2c352..2d2de49 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.21]
+        go-version: [1.26]
     steps:
       - name: checkout source code
         uses: actions/checkout@v3
diff --git a/entrypoint.sh b/entrypoint.sh
index e597d51..f559d67 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -2,4 +2,14 @@
 
 set -eu
 
+# GitHub supplies omitted inputs as empty strings. Leave optional lists unset
+# so the CLI does not submit an empty layer ARN or architecture to AWS.
+[ -n "${INPUT_SOURCE:-}" ] || unset INPUT_SOURCE
+[ -n "${INPUT_ENVIRONMENT:-}" ] || unset INPUT_ENVIRONMENT
+[ -n "${INPUT_LAYERS:-}" ] || unset INPUT_LAYERS
+[ -n "${INPUT_SUBNETS:-}" ] || unset INPUT_SUBNETS
+[ -n "${INPUT_SECURITYGROUPS:-}" ] || unset INPUT_SECURITYGROUPS
+[ -n "${INPUT_SECURITY_GROUPS:-}" ] || unset INPUT_SECURITY_GROUPS
+[ -n "${INPUT_ARCHITECTURES:-}" ] || unset INPUT_ARCHITECTURES
+
 sh -c "/bin/drone-lambda $*"
diff --git a/example/go.mod b/example/go.mod
index 93aeeb1..254bbfc 100644
--- a/example/go.mod
+++ b/example/go.mod
@@ -1,6 +1,6 @@
 module lambda
 
-go 1.21
+go 1.25.0
 
 require (
 	github.com/apex/gateway v1.1.2
@@ -30,10 +30,10 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.12 // indirect
 	golang.org/x/arch v0.8.0 // indirect
-	golang.org/x/crypto v0.24.0 // indirect
-	golang.org/x/net v0.26.0 // indirect
-	golang.org/x/sys v0.21.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/example/go.sum b/example/go.sum
index 5cfaf4e..1aa05c6 100644
--- a/example/go.sum
+++ b/example/go.sum
@@ -82,16 +82,16 @@ github.com/urfave/cli/v2 v2.1.1/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2
 golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
 golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
-golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
-golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=