diff --git a/terraform/environments/offsite/.terraform.lock.hcl b/terraform/environments/offsite/.terraform.lock.hcl
new file mode 100644
index 0000000..987ecd7
--- /dev/null
+++ b/terraform/environments/offsite/.terraform.lock.hcl
@@ -0,0 +1,23 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hetznercloud/hcloud" {
+  version     = "1.65.0"
+  constraints = "~> 1.65"
+  hashes = [
+    "h1:brGYSR/X+oOGHL+eZLMLmfW/xC9l4lEtS5ApM99lHa0=",
+    "zh:069b04e00c5b407d225856542513f2e6b87d99ec18dac76a7f682154cdbb3ec1",
+    "zh:0bcae45e0e7db18627d6f9bb5ce410fe249e4c056ca6f9c44b36090ce0074241",
+    "zh:0c11a8a2986d2492e0ef7f5ab7cdbca09ee14e44ffe356c7d8f50d5a598c6cc6",
+    "zh:26f8eb2d8d5e061f9cd8f543599276164a58b7227e6b3d15fdc195a9e2d3ad7b",
+    "zh:3af2159aab300ecca70276239489eb4f7913d56ef84b5675690fbc635fe2f9ae",
+    "zh:4db4ce21f9fdd34f317f5aaef32dfbb6978d0a5cfb510943fd3a919e4175e5fb",
+    "zh:6dbad73db5e1b4dbbad06ccfbd8b94f9b67acd702abda489f78badba9c68e292",
+    "zh:99008d3b585aba5ca90d3749e84931f5fa9213d97576eb1ced998816fc821ee8",
+    "zh:c4e98abc0dc9b7057cbf83fb14809948789d50ced5fd9ac993f0115ebb0dbfea",
+    "zh:cc801520ebd778826dfcb62f52d2aa909a1b7424e3ee14999b9de1225c276465",
+    "zh:dc9fefbe06b188cb3e7ab1f51437325b6c5374f0fff9dd63b1b0b9196b281e64",
+    "zh:ed2a73462cfa74cc6122440faac7ebc7f642e3441bea24ec7e1567e4b0401bb4",
+    "zh:fa4b87e313b8c3037ea517e8008caa8852ef71ba867f38e4e3c86488f6d5889a",
+  ]
+}
diff --git a/terraform/modules/hetzner_vm/versions.tf b/terraform/modules/hetzner_vm/versions.tf
new file mode 100644
index 0000000..c001b35
--- /dev/null
+++ b/terraform/modules/hetzner_vm/versions.tf
@@ -0,0 +1,10 @@
+# Child modules must declare required_providers for non-hashicorp providers, or
+# Terraform infers `hashicorp/hcloud` (which does not exist). The root env pins the
+# version; the module only maps the local name to the source.
+terraform {
+  required_providers {
+    hcloud = {
+      source = "hetznercloud/hcloud"
+    }
+  }
+}
diff --git a/terraform/modules/proxmox_vm/versions.tf b/terraform/modules/proxmox_vm/versions.tf
new file mode 100644
index 0000000..450bdf3
--- /dev/null
+++ b/terraform/modules/proxmox_vm/versions.tf
@@ -0,0 +1,10 @@
+# Child modules must declare required_providers for non-hashicorp providers, or
+# Terraform infers `hashicorp/proxmox` (which does not exist). The root env pins the
+# version; the module only maps the local name to the source.
+terraform {
+  required_providers {
+    proxmox = {
+      source = "bpg/proxmox"
+    }
+  }
+}