diff --git a/docs/hardening/resource_budgets.md b/docs/hardening/resource_budgets.md
index 6153a25..d90a51b 100644
--- a/docs/hardening/resource_budgets.md
+++ b/docs/hardening/resource_budgets.md
@@ -51,6 +51,8 @@ Covered benchmark families:
 
 - Budgets are intentionally conservative to reduce false positives in shared CI environments.
 - `BenchmarkInstallLocalTypical` budget reflects full local install integrity work (JCS digest, signature verification, and atomic fsync writes), not a metadata-only path.
+- Absolute `max_ns_op` ceilings should stay rounded above repeated release-host medians and close to the baseline regression envelope tracked in `perf/bench_baseline.json`.
+- When a benchmark repeatedly lands within a few percent of the regression ceiling on supported release hosts, refresh the baseline or factor in the same change that established the new steady state.
 - Tightening a budget requires:
   1. Baseline refresh in `perf/bench_baseline.json`
   2. Updated budget rationale in this document
diff --git a/perf/bench_baseline.json b/perf/bench_baseline.json
index 8420096..d4b422c 100644
--- a/perf/bench_baseline.json
+++ b/perf/bench_baseline.json
@@ -3,7 +3,7 @@
   "benchmarks": {
     "BenchmarkEvaluatePolicyTypical": {
       "baseline_ns_op": 7054,
-      "max_regression_factor": 4.0
+      "max_regression_factor": 4.2
     },
     "BenchmarkVerifyZipTypical": {
       "baseline_ns_op": 98898,
diff --git a/perf/resource_budgets.json b/perf/resource_budgets.json
index 5e5ae7c..daac2ee 100644
--- a/perf/resource_budgets.json
+++ b/perf/resource_budgets.json
@@ -4,15 +4,15 @@
     "max_allocs_op": 320
   },
   "BenchmarkVerifyZipTypical": {
-    "max_ns_op": 260000,
+    "max_ns_op": 400000,
     "max_allocs_op": 700
   },
   "BenchmarkDiffRunpacksTypical": {
-    "max_ns_op": 900000,
+    "max_ns_op": 1000000,
     "max_allocs_op": 3500
   },
   "BenchmarkSnapshotTypical": {
-    "max_ns_op": 220000,
+    "max_ns_op": 255000,
     "max_allocs_op": 900
   },
   "BenchmarkDiffSnapshotsTypical": {
@@ -20,15 +20,15 @@
     "max_allocs_op": 20
   },
   "BenchmarkVerifyPackTypical": {
-    "max_ns_op": 220000,
+    "max_ns_op": 280000,
     "max_allocs_op": 350
   },
   "BenchmarkBuildIncidentPackTypical": {
-    "max_ns_op": 1600000,
+    "max_ns_op": 2600000,
     "max_allocs_op": 3500
   },
   "BenchmarkInstallLocalTypical": {
-    "max_ns_op": 25000000,
+    "max_ns_op": 30000000,
     "max_allocs_op": 700
   },
   "BenchmarkVerifyInstalledTypical": {