diff --git a/src/core/services/appleCredentialsClient.ts b/src/core/services/appleCredentialsClient.ts
index ed57626..ca0fccf 100644
--- a/src/core/services/appleCredentialsClient.ts
+++ b/src/core/services/appleCredentialsClient.ts
@@ -46,7 +46,7 @@ export type AppleCredentialsClient = Readonly<{
     name: string,
     bundleIdResourceId: string,
     certificateId: string,
-    deviceIds: string[],
+    deviceIds: readonly string[],
     profileType: 'IOS_APP_ADHOC' | 'TVOS_APP_ADHOC',
   ) => Effect.Effect<ProfileResource, unknown>;
   readonly listBundleIdCapabilities: (
diff --git a/src/core/services/artifactRetention.ts b/src/core/services/artifactRetention.ts
index 1c6dc55..e1db847 100644
--- a/src/core/services/artifactRetention.ts
+++ b/src/core/services/artifactRetention.ts
@@ -10,9 +10,9 @@ import type { BuildArtifact, PruneOptions, PruneResult } from '../types/artifact
 
 /** Artifact-index persistence and retention operations used by storage providers. */
 export type ArtifactRetentionService = Readonly<{
-  readonly readIndex: (indexPath: string) => Effect.Effect<BuildArtifact[]>;
+  readonly readIndex: (indexPath: string) => Effect.Effect<readonly BuildArtifact[]>;
   readonly writeIndex: (
-    artifactIndex: BuildArtifact[],
+    artifactIndex: readonly BuildArtifact[],
     indexPath: string,
   ) => Effect.Effect<void, PlatformError>;
   readonly prune: (
diff --git a/src/core/services/localCredentialsStore.ts b/src/core/services/localCredentialsStore.ts
index 5333f56..e6f1f47 100644
--- a/src/core/services/localCredentialsStore.ts
+++ b/src/core/services/localCredentialsStore.ts
@@ -35,7 +35,7 @@ export type LocalCredentialsStoreService = Readonly<{
   readonly loadAppleSigningAssets: (
     keyId: string,
     bundleId: string,
-    extensions?: string[],
+    extensions?: readonly string[],
   ) => Effect.Effect<SigningAssets | null, unknown>;
   readonly loadPlayServiceAccount: () => Effect.Effect<string | null, unknown>;
   readonly loadAndroidKeystore: () => Effect.Effect<KeystoreAssets | null, unknown>;
diff --git a/src/core/services/logger.ts b/src/core/services/logger.ts
index 1675262..87bfaee 100644
--- a/src/core/services/logger.ts
+++ b/src/core/services/logger.ts
@@ -24,8 +24,8 @@ export type Logger = Readonly<{
   readonly note: (message: string) => LogWrite;
   readonly tip: (message: string) => LogWrite;
   readonly notice: (lead: string, ...details: string[]) => LogWrite;
-  readonly box: (title: string, receiptLines: string[]) => LogWrite;
-  readonly shipped: (receiptLines: string[]) => LogWrite;
+  readonly box: (title: string, receiptLines: readonly string[]) => LogWrite;
+  readonly shipped: (receiptLines: readonly string[]) => LogWrite;
   readonly line: (message: string) => LogWrite;
   readonly gap: () => LogWrite;
 }>;
diff --git a/src/core/services/progress.ts b/src/core/services/progress.ts
index cb1703a..0807429 100644
--- a/src/core/services/progress.ts
+++ b/src/core/services/progress.ts
@@ -135,7 +135,7 @@ const logStamp = (epochMilliseconds: number): string => {
  * the full log on disk (falling back to the in-memory tail if it can't be read), since the real cause
  * sometimes precedes the trailing lines.
  */
-const reportFailure = (label: string, tail: string[], logFile: string) =>
+const reportFailure = (label: string, tail: readonly string[], logFile: string) =>
   Effect.gen(function* () {
     const lines = [
       `${label} failed. Last lines:`,
@@ -160,7 +160,11 @@ const reportFailure = (label: string, tail: string[], logFile: string) =>
  * shows the live step from `parseStep` and a running clock; on failure the tail and log path are
  * printed before the error propagates. In stream mode it is exactly {@link run} (inherited stdio).
  */
-export const runWithProgress = (command: string, args: string[], options: ProgressRunOptions) =>
+export const runWithProgress = (
+  command: string,
+  args: readonly string[],
+  options: ProgressRunOptions,
+) =>
   Effect.gen(function* () {
     const { label, parseStep, ...progressCommandOptions } = options;
     const commandOptions: {
diff --git a/src/core/services/sandbox.ts b/src/core/services/sandbox.ts
index a8a8c06..5e7ae24 100644
--- a/src/core/services/sandbox.ts
+++ b/src/core/services/sandbox.ts
@@ -3,7 +3,7 @@ import type { SandboxTesterResource } from '../types/appleCatalog.js';
 /** The exact slice of {@link AppStoreConnectClient} the sandbox domain depends on. */
 export type AscSandboxApi = {
   listSandboxTesters(): Effect.Effect<SandboxTesterResource[], unknown>;
-  clearSandboxTesterPurchaseHistory(testerIds: string[]): Effect.Effect<void, unknown>;
+  clearSandboxTesterPurchaseHistory(testerIds: readonly string[]): Effect.Effect<void, unknown>;
 };
 export type SandboxRequestFailure = Readonly<{
   readonly _tag: 'SandboxRequestFailure';
diff --git a/src/core/services/ssh.ts b/src/core/services/ssh.ts
index b4153f1..7b99fe5 100644
--- a/src/core/services/ssh.ts
+++ b/src/core/services/ssh.ts
@@ -80,7 +80,7 @@ export const rsyncUp = (
   target: SshTarget,
   localDir: string,
   remoteDir: string,
-  excludes: string[],
+  excludes: readonly string[],
 ) => {
   const sshCommand = ['ssh', ...sshFlags(target)].join(' ');
   const args = ['-az', '--delete', '-e', sshCommand];