- Decouple Secure Link Connector updates from Gateway releases so Gateway upgrades preserve running connector sessions - Add trusted Relay manifests that carry the digest-pinned Secure Link Connector image - Apply connector changes only inside the explicit Relay maintenance window