diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad2dfda..28034a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,3 +7,6 @@
   - add response.text to errors for notify lamba code
   - add examples/
 
+- 1.0.2 -- 2025-08-15
+  - pin external TF module versions
+  - update README with external module links
diff --git a/README.md b/README.md
index 5774e3f..701fb87 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,11 @@ module "darhts-s3-transfer" {
   }
 }
 ```
+# Links
+This uses a number of external modules.
+* [terraform-aws-eventbridge](https://registry.terraform.io/modules/terraform-aws-modules/eventbridge/aws/4.1.0)
+* [terraform-aws-lambda](https://registry.terraform.io/modules/terraform-aws-modules/lambda/aws/8.0.1)
+* [terraform-aws-sqs](https://registry.terraform.io/modules/terraform-aws-modules/lambda/sqs/5.0.0)
 
 ## Requirements
 
@@ -67,25 +72,25 @@ module "darhts-s3-transfer" {
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_base"></a> [base](#module\_base) | git@github.e.it.census.gov:terraform-modules/boc-nts//base-label | n/a |
-| <a name="module_eventbridge_guardduty"></a> [eventbridge\_guardduty](#module\_eventbridge\_guardduty) | terraform-aws-modules/eventbridge/aws | n/a |
-| <a name="module_eventbridge_s3"></a> [eventbridge\_s3](#module\_eventbridge\_s3) | terraform-aws-modules/eventbridge/aws | n/a |
+| <a name="module_eventbridge_guardduty"></a> [eventbridge\_guardduty](#module\_eventbridge\_guardduty) | terraform-aws-modules/eventbridge/aws | 4.1.0 |
+| <a name="module_eventbridge_s3"></a> [eventbridge\_s3](#module\_eventbridge\_s3) | terraform-aws-modules/eventbridge/aws | 4.1.0 |
 | <a name="module_files_clean"></a> [files\_clean](#module\_files\_clean) | git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard | tf-upgrade |
 | <a name="module_files_in"></a> [files\_in](#module\_files\_in) | git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard | tf-upgrade |
 | <a name="module_files_out_clean"></a> [files\_out\_clean](#module\_files\_out\_clean) | git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard | tf-upgrade |
 | <a name="module_files_quarantine"></a> [files\_quarantine](#module\_files\_quarantine) | git@github.e.it.census.gov:terraform-modules/aws-s3.git//standard | tf-upgrade |
-| <a name="module_lambda_layer"></a> [lambda\_layer](#module\_lambda\_layer) | terraform-aws-modules/lambda/aws | n/a |
-| <a name="module_lambda_move"></a> [lambda\_move](#module\_lambda\_move) | terraform-aws-modules/lambda/aws | n/a |
-| <a name="module_lambda_move_alias"></a> [lambda\_move\_alias](#module\_lambda\_move\_alias) | terraform-aws-modules/lambda/aws//modules/alias | n/a |
-| <a name="module_lambda_move_failure"></a> [lambda\_move\_failure](#module\_lambda\_move\_failure) | terraform-aws-modules/sqs/aws | n/a |
-| <a name="module_lambda_notify"></a> [lambda\_notify](#module\_lambda\_notify) | terraform-aws-modules/lambda/aws | n/a |
-| <a name="module_lambda_notify_alias"></a> [lambda\_notify\_alias](#module\_lambda\_notify\_alias) | terraform-aws-modules/lambda/aws//modules/alias | n/a |
-| <a name="module_lambda_notify_failure"></a> [lambda\_notify\_failure](#module\_lambda\_notify\_failure) | terraform-aws-modules/sqs/aws | n/a |
-| <a name="module_lambda_s3"></a> [lambda\_s3](#module\_lambda\_s3) | terraform-aws-modules/lambda/aws | n/a |
-| <a name="module_lambda_s3_alias"></a> [lambda\_s3\_alias](#module\_lambda\_s3\_alias) | terraform-aws-modules/lambda/aws//modules/alias | n/a |
-| <a name="module_lambda_s3_failure"></a> [lambda\_s3\_failure](#module\_lambda\_s3\_failure) | terraform-aws-modules/sqs/aws | n/a |
-| <a name="module_lambda_s3_tag"></a> [lambda\_s3\_tag](#module\_lambda\_s3\_tag) | terraform-aws-modules/lambda/aws | n/a |
-| <a name="module_lambda_s3_tag_alias"></a> [lambda\_s3\_tag\_alias](#module\_lambda\_s3\_tag\_alias) | terraform-aws-modules/lambda/aws//modules/alias | n/a |
-| <a name="module_lambda_s3_tag_failure"></a> [lambda\_s3\_tag\_failure](#module\_lambda\_s3\_tag\_failure) | terraform-aws-modules/sqs/aws | n/a |
+| <a name="module_lambda_layer"></a> [lambda\_layer](#module\_lambda\_layer) | terraform-aws-modules/lambda/aws | 8.0.1 |
+| <a name="module_lambda_move"></a> [lambda\_move](#module\_lambda\_move) | terraform-aws-modules/lambda/aws | 8.0.1 |
+| <a name="module_lambda_move_alias"></a> [lambda\_move\_alias](#module\_lambda\_move\_alias) | terraform-aws-modules/lambda/aws//modules/alias | 8.0.1 |
+| <a name="module_lambda_move_failure"></a> [lambda\_move\_failure](#module\_lambda\_move\_failure) | terraform-aws-modules/sqs/aws | 5.0.0 |
+| <a name="module_lambda_notify"></a> [lambda\_notify](#module\_lambda\_notify) | terraform-aws-modules/lambda/aws | 8.0.1 |
+| <a name="module_lambda_notify_alias"></a> [lambda\_notify\_alias](#module\_lambda\_notify\_alias) | terraform-aws-modules/lambda/aws//modules/alias | 8.0.1 |
+| <a name="module_lambda_notify_failure"></a> [lambda\_notify\_failure](#module\_lambda\_notify\_failure) | terraform-aws-modules/sqs/aws | 5.0.0 |
+| <a name="module_lambda_s3"></a> [lambda\_s3](#module\_lambda\_s3) | terraform-aws-modules/lambda/aws | 8.0.1 |
+| <a name="module_lambda_s3_alias"></a> [lambda\_s3\_alias](#module\_lambda\_s3\_alias) | terraform-aws-modules/lambda/aws//modules/alias | 8.0.1 |
+| <a name="module_lambda_s3_failure"></a> [lambda\_s3\_failure](#module\_lambda\_s3\_failure) | terraform-aws-modules/sqs/aws | 5.0.0 |
+| <a name="module_lambda_s3_tag"></a> [lambda\_s3\_tag](#module\_lambda\_s3\_tag) | terraform-aws-modules/lambda/aws | 8.0.1 |
+| <a name="module_lambda_s3_tag_alias"></a> [lambda\_s3\_tag\_alias](#module\_lambda\_s3\_tag\_alias) | terraform-aws-modules/lambda/aws//modules/alias | 8.0.1 |
+| <a name="module_lambda_s3_tag_failure"></a> [lambda\_s3\_tag\_failure](#module\_lambda\_s3\_tag\_failure) | terraform-aws-modules/sqs/aws | 5.0.0 |
 
 ## Resources
 
diff --git a/eventbridge.guardduty.tf b/eventbridge.guardduty.tf
index 7b12e37..6214aa1 100644
--- a/eventbridge.guardduty.tf
+++ b/eventbridge.guardduty.tf
@@ -44,6 +44,7 @@ resource "aws_cloudwatch_log_resource_policy" "guardduty_event_log" {
 
 module "eventbridge_guardduty" {
   source    = "terraform-aws-modules/eventbridge/aws"
+  version   = "4.1.0"
   role_name = format("%v%v-%v-%v", try(module.base.prefixes.role, ""), var.input_resource_label, "in", "guardduty")
 
   append_rule_postfix = false
diff --git a/eventbridge.s3.tf b/eventbridge.s3.tf
index d671431..ee15834 100644
--- a/eventbridge.s3.tf
+++ b/eventbridge.s3.tf
@@ -1,5 +1,6 @@
 module "eventbridge_s3" {
   source    = "terraform-aws-modules/eventbridge/aws"
+  version   = "4.1.0"
   role_name = format("%v%v-%v-%v", try(module.base.prefixes.role, ""), var.input_resource_label, "clean", "s3")
 
   append_rule_postfix = false
diff --git a/lambda.layer.tf b/lambda.layer.tf
index d03dadf..ab1a65d 100644
--- a/lambda.layer.tf
+++ b/lambda.layer.tf
@@ -1,5 +1,6 @@
 module "lambda_layer" {
-  source = "terraform-aws-modules/lambda/aws"
+  source  = "terraform-aws-modules/lambda/aws"
+  version = "8.0.1"
 
   create_layer = true
   #  create_package = true
diff --git a/lambda.move.tf b/lambda.move.tf
index c868d34..dd5537c 100644
--- a/lambda.move.tf
+++ b/lambda.move.tf
@@ -1,5 +1,6 @@
 module "lambda_move" {
-  source = "terraform-aws-modules/lambda/aws"
+  source  = "terraform-aws-modules/lambda/aws"
+  version = "8.0.1"
 
   create_function           = true
   create_package            = false
@@ -73,7 +74,8 @@ module "lambda_move" {
 }
 
 module "lambda_move_alias" {
-  source = "terraform-aws-modules/lambda/aws//modules/alias"
+  source  = "terraform-aws-modules/lambda/aws//modules/alias"
+  version = "8.0.1"
 
   name             = module.lambda_move.lambda_function_name
   function_name    = module.lambda_move.lambda_function_name
@@ -147,8 +149,9 @@ data "aws_iam_policy_document" "lambda_move" {
 }
 
 module "lambda_move_failure" {
-  source = "terraform-aws-modules/sqs/aws"
-  name   = format("%v-move-failure", var.input_resource_label)
+  source  = "terraform-aws-modules/sqs/aws"
+  version = "5.0.0"
+  name    = format("%v-move-failure", var.input_resource_label)
 
   sqs_managed_sse_enabled = true
   create_queue_policy     = true
diff --git a/lambda.notify.tf b/lambda.notify.tf
index 1c16ed3..957f1c6 100644
--- a/lambda.notify.tf
+++ b/lambda.notify.tf
@@ -1,5 +1,6 @@
 module "lambda_notify" {
-  source = "terraform-aws-modules/lambda/aws"
+  source  = "terraform-aws-modules/lambda/aws"
+  version = "8.0.1"
 
   create_function = true
   #  create_package            = true
@@ -91,7 +92,8 @@ module "lambda_notify" {
 }
 
 module "lambda_notify_alias" {
-  source = "terraform-aws-modules/lambda/aws//modules/alias"
+  source  = "terraform-aws-modules/lambda/aws//modules/alias"
+  version = "8.0.1"
 
   name             = module.lambda_notify.lambda_function_name
   function_name    = module.lambda_notify.lambda_function_name
@@ -131,8 +133,9 @@ data "aws_iam_policy_document" "lambda_notify" {
 }
 
 module "lambda_notify_failure" {
-  source = "terraform-aws-modules/sqs/aws"
-  name   = format("%v-guardduty-notify-failure", var.input_resource_label)
+  source  = "terraform-aws-modules/sqs/aws"
+  version = "5.0.0"
+  name    = format("%v-guardduty-notify-failure", var.input_resource_label)
 
   sqs_managed_sse_enabled = true
   create_queue_policy     = true
diff --git a/lambda.s3-tag.tf b/lambda.s3-tag.tf
index 89a69cf..f3053a7 100644
--- a/lambda.s3-tag.tf
+++ b/lambda.s3-tag.tf
@@ -1,5 +1,6 @@
 module "lambda_s3_tag" {
-  source = "terraform-aws-modules/lambda/aws"
+  source  = "terraform-aws-modules/lambda/aws"
+  version = "8.0.1"
 
   create_function = true
   #  create_package            = true
@@ -90,7 +91,8 @@ module "lambda_s3_tag" {
 }
 
 module "lambda_s3_tag_alias" {
-  source = "terraform-aws-modules/lambda/aws//modules/alias"
+  source  = "terraform-aws-modules/lambda/aws//modules/alias"
+  version = "8.0.1"
 
   name             = module.lambda_s3_tag.lambda_function_name
   function_name    = module.lambda_s3_tag.lambda_function_name
@@ -138,8 +140,9 @@ data "aws_iam_policy_document" "lambda_s3_tag" {
 }
 
 module "lambda_s3_tag_failure" {
-  source = "terraform-aws-modules/sqs/aws"
-  name   = format("%v-s3-tag-failure", var.input_resource_label)
+  source  = "terraform-aws-modules/sqs/aws"
+  version = "5.0.0"
+  name    = format("%v-s3-tag-failure", var.input_resource_label)
 
   sqs_managed_sse_enabled = true
   create_queue_policy     = true
diff --git a/lambda.s3.tf b/lambda.s3.tf
index 6d0ef45..ae594b3 100644
--- a/lambda.s3.tf
+++ b/lambda.s3.tf
@@ -1,5 +1,6 @@
 module "lambda_s3" {
-  source = "terraform-aws-modules/lambda/aws"
+  source  = "terraform-aws-modules/lambda/aws"
+  version = "8.0.1"
 
   create_function = true
   #  create_package            = true
@@ -91,7 +92,8 @@ module "lambda_s3" {
 }
 
 module "lambda_s3_alias" {
-  source = "terraform-aws-modules/lambda/aws//modules/alias"
+  source  = "terraform-aws-modules/lambda/aws//modules/alias"
+  version = "8.0.1"
 
   name             = module.lambda_s3.lambda_function_name
   function_name    = module.lambda_s3.lambda_function_name
@@ -131,8 +133,9 @@ data "aws_iam_policy_document" "lambda_s3" {
 }
 
 module "lambda_s3_failure" {
-  source = "terraform-aws-modules/sqs/aws"
-  name   = format("%v-s3-notify-failure", var.input_resource_label)
+  source  = "terraform-aws-modules/sqs/aws"
+  version = "5.0.0"
+  name    = format("%v-s3-notify-failure", var.input_resource_label)
 
   sqs_managed_sse_enabled = true
   create_queue_policy     = true
diff --git a/main.tf b/main.tf
index e75176b..fec6626 100644
--- a/main.tf
+++ b/main.tf
@@ -48,6 +48,11 @@
 *   }
 * }
 * ```
+* # Links
+* This uses a number of external modules.
+* * [terraform-aws-eventbridge](https://registry.terraform.io/modules/terraform-aws-modules/eventbridge/aws/4.1.0)
+* * [terraform-aws-lambda](https://registry.terraform.io/modules/terraform-aws-modules/lambda/aws/8.0.1)
+* * [terraform-aws-sqs](https://registry.terraform.io/modules/terraform-aws-modules/lambda/sqs/5.0.0)
 */
 
 locals {
diff --git a/version.tf b/version.tf
index 7e414a6..fa9adf9 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-app-ditd-darhts-s3-transfer"
-  _module_version = "1.0.1"
+  _module_version = "1.0.2"
 }