diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f448ea0..93b1a002 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -139,8 +139,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - **`aws/opensearch`:** the OpenSearch purchase path uses the shared `purchaseguard` idempotency guard and AlreadyExists recovery, like ElastiCache. Behavior for valid purchases is unchanged (#10).
 - **`azure/cache`:** `GetValidResourceTypes` now returns an error when the Redis cache list reaches the page cap (#249) instead of logging a warning and returning a partial SKU set.
 - **`scripts/setup-git-secrets.sh`:** the database DSN detector now fires on `user:password@host` (the old pattern ended at `@`, which `git-secrets`' word-match scan rejected before a hostname), and also covers `postgresql`, `mariadb`, driver-suffixed schemes and empty usernames (#125).
-- **`provider`:** `ProviderConfig` is renamed to `Config` (#39). `ProviderConfig` stays as a deprecated type alias, so existing consumers keep compiling; migrate to `provider.Config`. The provider modules move over once their pinned `pkg` version includes the rename.
-- **`provider`:** `ProviderConfig` is renamed to `Config` (#39). `ProviderConfig` stays as a type alias, so existing consumers keep compiling; migrate to `provider.Config`. The provider modules move over once their pinned `pkg` version includes the rename.
+- **`provider`:** `ProviderConfig` is renamed to `Config` (#39). `ProviderConfig` stays as a type alias marked `Deprecated: use Config.`, so existing consumers keep compiling, but consumers that run staticcheck with fatal warnings (cloud-commitments-mcp, ~86 uses, and cloud-commitments-platform, ~36 uses) fail lint with SA1019 on their next `pkg` bump until they migrate to `provider.Config`. The `aws`, `azure` and `gcp` provider modules and `ci_cd_sanity_tests` already use `provider.Config`.
 - **`httpclient`:** dials to the RFC 8215 local-use NAT64 prefix `64:ff9b:1::/48` are refused when any RFC 6052 layout (/48, /56, /64, /96) embeds a metadata IPv4 address; Teredo `2001::/32` stays allowed (#238).
 - **CI:** the security-scan job runs a pinned gitleaks CLI (v8.30.1, sha256-verified) over the checkout with `.gitleaks.toml` and fails on any finding (#101).
 - **`common.HoursPerMonth`:** exported 730-hour average month (`HoursPerYear / 12`) next to `HoursPerYear`; the remaining bare 730 and 8760 literals in the aws and gcp providers use the shared constants (#109).
diff --git a/ci_cd_sanity_tests/go.mod b/ci_cd_sanity_tests/go.mod
index b8123c6f..70d23083 100644
--- a/ci_cd_sanity_tests/go.mod
+++ b/ci_cd_sanity_tests/go.mod
@@ -41,7 +41,7 @@ require (
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
-	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54
+	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3
 	github.com/aws/aws-sdk-go-v2/service/sts v1.33.17
 )
 
diff --git a/ci_cd_sanity_tests/go.sum b/ci_cd_sanity_tests/go.sum
index ff878317..d9381b75 100644
--- a/ci_cd_sanity_tests/go.sum
+++ b/ci_cd_sanity_tests/go.sum
@@ -20,8 +20,8 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54 h1:BD0kJ6paMgtNkmwkypmbcWcbVreIkrv1r0bxzR7kf2E=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54/go.mod h1:/yCOnBtEJRRydFrDm6g1UcHuJwuB35AqYTBdaHDG8wo=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3 h1:NBjYpYKzw1mRs77nRaCya+HcuJdV6SaPCJEbJVbza0U=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3/go.mod h1:awNjqN4KJHvFvb2wzKWrwXK954pkHtevPl0TtYkS2io=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/aws-sdk-go-v2/config v1.29.12 h1:Y/2a+jLPrPbHpFkpAAYkVEtJmxORlXoo5k2g1fa2sUo=
diff --git a/pkg/provider/interface.go b/pkg/provider/interface.go
index e6ae35f3..49ce45e4 100644
--- a/pkg/provider/interface.go
+++ b/pkg/provider/interface.go
@@ -113,8 +113,9 @@ type Config struct {
 }
 
 // ProviderConfig is the former name of Config, kept so external consumers keep
-// compiling. Use Config. The "Deprecated:" marker is added once the provider
-// modules, which still pin a pkg version without Config, have migrated.
+// compiling.
+//
+// Deprecated: use Config.
 //
 //nolint:revive // kept for external consumers; remove once none reference it
 type ProviderConfig = Config
diff --git a/providers/aws/go.mod b/providers/aws/go.mod
index 7d2b423a..9b43fd22 100644
--- a/providers/aws/go.mod
+++ b/providers/aws/go.mod
@@ -3,7 +3,7 @@ module github.com/LeanerCloud/cloud-commitments-go/providers/aws
 go 1.26.9
 
 require (
-	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54
+	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3
 	github.com/aws/aws-sdk-go-v2 v1.41.5
 	github.com/aws/aws-sdk-go-v2/config v1.29.12
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.65
diff --git a/providers/aws/go.sum b/providers/aws/go.sum
index 6f926d7c..32d8d29f 100644
--- a/providers/aws/go.sum
+++ b/providers/aws/go.sum
@@ -1,5 +1,5 @@
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54 h1:BD0kJ6paMgtNkmwkypmbcWcbVreIkrv1r0bxzR7kf2E=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54/go.mod h1:/yCOnBtEJRRydFrDm6g1UcHuJwuB35AqYTBdaHDG8wo=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3 h1:NBjYpYKzw1mRs77nRaCya+HcuJdV6SaPCJEbJVbza0U=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3/go.mod h1:awNjqN4KJHvFvb2wzKWrwXK954pkHtevPl0TtYkS2io=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/aws-sdk-go-v2/config v1.29.12 h1:Y/2a+jLPrPbHpFkpAAYkVEtJmxORlXoo5k2g1fa2sUo=
diff --git a/providers/aws/provider.go b/providers/aws/provider.go
index f8df8a52..d505fd8f 100644
--- a/providers/aws/provider.go
+++ b/providers/aws/provider.go
@@ -98,7 +98,7 @@ type Provider struct {
 // Profile resolution order:
 //  1. config.AWSProfile (typed field, preferred)
 //  2. config.Profile (deprecated overload — kept for backwards compatibility)
-func NewAWSProvider(cfg *provider.ProviderConfig) (*Provider, error) {
+func NewAWSProvider(cfg *provider.Config) (*Provider, error) {
 	p := &Provider{}
 
 	if cfg != nil {
@@ -112,7 +112,7 @@ func NewAWSProvider(cfg *provider.ProviderConfig) (*Provider, error) {
 
 // resolveAWSProfile picks the AWS profile name from the typed field,
 // falling back to the deprecated Profile field.
-func resolveAWSProfile(cfg *provider.ProviderConfig) string {
+func resolveAWSProfile(cfg *provider.Config) string {
 	if cfg.AWSProfile != "" {
 		return cfg.AWSProfile
 	}
@@ -510,7 +510,7 @@ func (p *Provider) GetRecommendationsClient(ctx context.Context) (provider.Recom
 
 // Register the AWS provider with the global registry.
 func init() {
-	if err := provider.RegisterProvider("aws", func(config *provider.ProviderConfig) (provider.Provider, error) {
+	if err := provider.RegisterProvider("aws", func(config *provider.Config) (provider.Provider, error) {
 		return NewAWSProvider(config)
 	}); err != nil {
 		panic("failed to register AWS provider: " + err.Error())
diff --git a/providers/aws/provider_test.go b/providers/aws/provider_test.go
index 243422c5..41520593 100644
--- a/providers/aws/provider_test.go
+++ b/providers/aws/provider_test.go
@@ -84,7 +84,7 @@ func TestNewAWSProvider(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name            string
-		config          *provider.ProviderConfig
+		config          *provider.Config
 		expectedProfile string
 		expectedRegion  string
 	}{
@@ -96,7 +96,7 @@ func TestNewAWSProvider(t *testing.T) {
 		},
 		{
 			name: "With region only",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Region: "us-west-2",
 			},
 			expectedProfile: "",
@@ -104,7 +104,7 @@ func TestNewAWSProvider(t *testing.T) {
 		},
 		{
 			name: "With profile only",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Profile: "my-profile",
 			},
 			expectedProfile: "my-profile",
@@ -112,7 +112,7 @@ func TestNewAWSProvider(t *testing.T) {
 		},
 		{
 			name: "With both profile and region",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Profile: "production",
 				Region:  "eu-west-1",
 			},
@@ -121,7 +121,7 @@ func TestNewAWSProvider(t *testing.T) {
 		},
 		{
 			name: "Typed AWSProfile takes precedence over deprecated Profile",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				AWSProfile: "typed-profile",
 				Profile:    "deprecated-profile",
 			},
@@ -130,7 +130,7 @@ func TestNewAWSProvider(t *testing.T) {
 		},
 		{
 			name: "Typed AWSProfile alone (no Profile fallback needed)",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				AWSProfile: "only-typed",
 			},
 			expectedProfile: "only-typed",
@@ -1020,7 +1020,7 @@ func TestProviderRegistration(t *testing.T) {
 	t.Run("AWS provider can be created with config via registry", func(t *testing.T) {
 		registry := provider.GetRegistry()
 
-		config := &provider.ProviderConfig{
+		config := &provider.Config{
 			Profile: "test-profile",
 			Region:  "us-west-2",
 		}
diff --git a/providers/azure/accounts_cache.go b/providers/azure/accounts_cache.go
index 523c0926..82925308 100644
--- a/providers/azure/accounts_cache.go
+++ b/providers/azure/accounts_cache.go
@@ -20,7 +20,7 @@ import (
 const accountsCacheSFKeyPrefix = "accounts-gen-"
 
 // azureSubscriptionIDEnv is the environment variable that pins the default
-// subscription when ProviderConfig carries none. Named rather than repeated
+// subscription when Config carries none. Named rather than repeated
 // as a literal because both resolveDefaultSubscription (which consumes it)
 // and GetRecommendationsClient (which reports it back in an error) depend on
 // it being the same variable.
@@ -269,7 +269,7 @@ func (p *Provider) fetchAccounts(ctx context.Context) ([]common.Account, error)
 // resolveDefaultSubscription sets IsDefault on the matching account in-place.
 //
 // Priority:
-//  1. explicitSubID (from ProviderConfig.AzureSubscriptionID / Profile).
+//  1. explicitSubID (from Config.AzureSubscriptionID / Profile).
 //  2. AZURE_SUBSCRIPTION_ID environment variable.
 //  3. When exactly one subscription is visible, mark it default (mirrors AWS
 //     behavior where the STS-identified account is always the default).
diff --git a/providers/azure/go.mod b/providers/azure/go.mod
index a6010e57..9051611d 100644
--- a/providers/azure/go.mod
+++ b/providers/azure/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armsubscriptions v1.3.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/search/armsearch v1.4.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql v1.2.0
-	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54
+	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/sync v0.23.0
 )
diff --git a/providers/azure/go.sum b/providers/azure/go.sum
index 903c5316..33712890 100644
--- a/providers/azure/go.sum
+++ b/providers/azure/go.sum
@@ -38,8 +38,8 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54 h1:BD0kJ6paMgtNkmwkypmbcWcbVreIkrv1r0bxzR7kf2E=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54/go.mod h1:/yCOnBtEJRRydFrDm6g1UcHuJwuB35AqYTBdaHDG8wo=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3 h1:NBjYpYKzw1mRs77nRaCya+HcuJdV6SaPCJEbJVbza0U=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3/go.mod h1:awNjqN4KJHvFvb2wzKWrwXK954pkHtevPl0TtYkS2io=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
diff --git a/providers/azure/provider.go b/providers/azure/provider.go
index eccd2f4c..4b67a752 100644
--- a/providers/azure/provider.go
+++ b/providers/azure/provider.go
@@ -141,7 +141,7 @@ type Provider struct {
 // azcore.TokenCredential, it is installed directly so all downstream clients
 // use those credentials. Otherwise, GetCredentials lazily falls back to
 // DefaultAzureCredential.
-func NewAzureProvider(config *provider.ProviderConfig) (*Provider, error) {
+func NewAzureProvider(config *provider.Config) (*Provider, error) {
 	p := &Provider{}
 
 	if config != nil {
@@ -165,7 +165,7 @@ func NewAzureProvider(config *provider.ProviderConfig) (*Provider, error) {
 
 // resolveAzureSubscriptionID picks the subscription ID from the typed field,
 // falling back to the deprecated Profile field.
-func resolveAzureSubscriptionID(config *provider.ProviderConfig) string {
+func resolveAzureSubscriptionID(config *provider.Config) string {
 	if config.AzureSubscriptionID != "" {
 		return config.AzureSubscriptionID
 	}
@@ -367,7 +367,7 @@ func (p *Provider) ValidateCredentials(ctx context.Context) error {
 // GetAccounts returns all accessible Azure subscriptions.
 //
 // IsDefault is set to true for the subscription that matches (in priority order):
-//  1. The AzureSubscriptionID set in ProviderConfig (or the Profile fallback).
+//  1. The AzureSubscriptionID set in Config (or the Profile fallback).
 //  2. The AZURE_SUBSCRIPTION_ID environment variable.
 //  3. The sole subscription, when exactly one is visible (mirrors AWS behavior
 //     where the STS-identified account is always the default).
@@ -381,7 +381,7 @@ func (p *Provider) GetAccounts(ctx context.Context) ([]common.Account, error) {
 // configuredSubscriptionTarget returns the subscription this provider was
 // explicitly told to operate on, together with a label naming the knob it came
 // from so an error can tell the operator what to fix. It mirrors
-// resolveDefaultSubscription's priority: the ProviderConfig field first (which
+// resolveDefaultSubscription's priority: the Config field first (which
 // resolveAzureSubscriptionID may itself have taken from the deprecated Profile
 // overload, hence the generic label), then AZURE_SUBSCRIPTION_ID. Both return
 // values are empty when nothing was configured.
@@ -719,7 +719,7 @@ func (p *Provider) GetRecommendationsClientForAccount(ctx context.Context, subsc
 
 // Register the Azure provider with the global registry.
 func init() {
-	if err := provider.RegisterProvider("azure", func(config *provider.ProviderConfig) (provider.Provider, error) {
+	if err := provider.RegisterProvider("azure", func(config *provider.Config) (provider.Provider, error) {
 		return NewAzureProvider(config)
 	}); err != nil {
 		panic("failed to register Azure provider: " + err.Error())
diff --git a/providers/azure/provider_test.go b/providers/azure/provider_test.go
index fe797745..7bb13c37 100644
--- a/providers/azure/provider_test.go
+++ b/providers/azure/provider_test.go
@@ -113,7 +113,7 @@ func TestNewAzureProvider(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name           string
-		config         *provider.ProviderConfig
+		config         *provider.Config
 		expectedRegion string
 		expectedSubID  string
 	}{
@@ -125,7 +125,7 @@ func TestNewAzureProvider(t *testing.T) {
 		},
 		{
 			name: "With region only",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Region: "westus2",
 			},
 			expectedRegion: "westus2",
@@ -133,7 +133,7 @@ func TestNewAzureProvider(t *testing.T) {
 		},
 		{
 			name: "With profile (subscription ID)",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Profile: "subscription-id-123",
 			},
 			expectedRegion: "",
@@ -141,7 +141,7 @@ func TestNewAzureProvider(t *testing.T) {
 		},
 		{
 			name: "With both region and profile",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Region:  "eastus",
 				Profile: "my-subscription",
 			},
@@ -150,7 +150,7 @@ func TestNewAzureProvider(t *testing.T) {
 		},
 		{
 			name: "Typed AzureSubscriptionID takes precedence over deprecated Profile",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				AzureSubscriptionID: "typed-sub-id",
 				Profile:             "deprecated-sub-id",
 			},
@@ -159,7 +159,7 @@ func TestNewAzureProvider(t *testing.T) {
 		},
 		{
 			name: "Typed AzureSubscriptionID alone (no Profile fallback needed)",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				AzureSubscriptionID: "only-typed",
 			},
 			expectedRegion: "",
@@ -186,7 +186,7 @@ func TestNewAzureProvider(t *testing.T) {
 func TestNewAzureProvider_TokenCredentialInjection(t *testing.T) {
 	t.Parallel()
 	t.Run("Nil credential leaves cred unset", func(t *testing.T) {
-		p, err := NewAzureProvider(&provider.ProviderConfig{
+		p, err := NewAzureProvider(&provider.Config{
 			AzureSubscriptionID: "sub-1",
 		})
 		require.NoError(t, err)
@@ -195,7 +195,7 @@ func TestNewAzureProvider_TokenCredentialInjection(t *testing.T) {
 
 	t.Run("Non-nil credential is stored on the provider", func(t *testing.T) {
 		fake := &mockTokenCredential{}
-		p, err := NewAzureProvider(&provider.ProviderConfig{
+		p, err := NewAzureProvider(&provider.Config{
 			AzureSubscriptionID:  "sub-1",
 			AzureTokenCredential: fake,
 		})
@@ -209,7 +209,7 @@ func TestNewAzureProvider_TokenCredentialInjection(t *testing.T) {
 		// "ADC unavailable" error. We don't capture the log output here
 		// (the project has no log-capture harness); the behavioral assertion
 		// is unchanged: p.cred stays nil and NewAzureProvider doesn't error.
-		p, err := NewAzureProvider(&provider.ProviderConfig{
+		p, err := NewAzureProvider(&provider.Config{
 			AzureSubscriptionID:  "sub-1",
 			AzureTokenCredential: "not-a-credential",
 		})
@@ -1971,7 +1971,7 @@ func TestAzureProvider_ResolveSubscription_InvisibleConfiguredTargetErrors(t *te
 		assert.Contains(t, err.Error(), "not among the 1 subscriptions visible")
 	})
 
-	// The same guard has to cover the ProviderConfig axis, not just the
+	// The same guard has to cover the Config axis, not just the
 	// environment variable: resolveDefaultSubscription's rule 1 reads
 	// p.subscriptionID and falls through to rule 3 identically when it misses.
 	t.Run("GetRegions errors on a config target the principal cannot see", func(t *testing.T) {
diff --git a/providers/gcp/go.mod b/providers/gcp/go.mod
index 42d71373..2707a4db 100644
--- a/providers/gcp/go.mod
+++ b/providers/gcp/go.mod
@@ -8,7 +8,7 @@ require (
 	cloud.google.com/go/redis v1.18.3
 	cloud.google.com/go/resourcemanager v1.10.7
 	cloud.google.com/go/storage v1.59.2
-	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54
+	github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3
 	github.com/googleapis/gax-go/v2 v2.21.0
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/oauth2 v0.36.0
diff --git a/providers/gcp/go.sum b/providers/gcp/go.sum
index 37a7faa7..5654cd04 100644
--- a/providers/gcp/go.sum
+++ b/providers/gcp/go.sum
@@ -36,8 +36,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 h1:s0WlVbf9qpvkh1c/uDAPElam0WrL7fHRIidgZJ7UqZI=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54 h1:BD0kJ6paMgtNkmwkypmbcWcbVreIkrv1r0bxzR7kf2E=
-github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020124817-768bc51a4c54/go.mod h1:/yCOnBtEJRRydFrDm6g1UcHuJwuB35AqYTBdaHDG8wo=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3 h1:NBjYpYKzw1mRs77nRaCya+HcuJdV6SaPCJEbJVbza0U=
+github.com/LeanerCloud/cloud-commitments-go/pkg v0.0.0-20261020191912-205cf99b8ef3/go.mod h1:awNjqN4KJHvFvb2wzKWrwXK954pkHtevPl0TtYkS2io=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
diff --git a/providers/gcp/provider.go b/providers/gcp/provider.go
index 361a6c0a..bca60a04 100644
--- a/providers/gcp/provider.go
+++ b/providers/gcp/provider.go
@@ -111,7 +111,7 @@ type Provider struct {
 // oauth2.TokenSource, it is installed via option.WithTokenSource so all
 // downstream clients use those credentials. Otherwise, clients fall back
 // to Application Default Credentials.
-func NewProvider(config *provider.ProviderConfig) (*Provider, error) {
+func NewProvider(config *provider.Config) (*Provider, error) {
 	ctx := context.Background()
 
 	projectID := resolveGCPProjectID(config)
@@ -146,7 +146,7 @@ func NewProvider(config *provider.ProviderConfig) (*Provider, error) {
 // resolveGCPProjectID picks the project ID from the typed field, falling
 // back to the deprecated Profile field. Returns "" if neither is set, which
 // signals the caller to consult ADC.
-func resolveGCPProjectID(config *provider.ProviderConfig) string {
+func resolveGCPProjectID(config *provider.Config) string {
 	if config == nil {
 		return ""
 	}
@@ -549,7 +549,7 @@ func findActiveProjectInPage(out *string, page *cloudresourcemanager.ListProject
 
 func init() {
 	// Register GCP provider in the global registry
-	if err := provider.RegisterProvider("gcp", func(config *provider.ProviderConfig) (provider.Provider, error) {
+	if err := provider.RegisterProvider("gcp", func(config *provider.Config) (provider.Provider, error) {
 		return NewProvider(config)
 	}); err != nil {
 		panic("failed to register GCP provider: " + err.Error())
diff --git a/providers/gcp/provider_test.go b/providers/gcp/provider_test.go
index 198c37ee..0e40ffe0 100644
--- a/providers/gcp/provider_test.go
+++ b/providers/gcp/provider_test.go
@@ -217,12 +217,12 @@ func TestNewProvider_ProjectIDResolution(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name     string
-		config   *provider.ProviderConfig
+		config   *provider.Config
 		expected string
 	}{
 		{
 			name: "Typed GCPProjectID takes precedence over deprecated Profile",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				GCPProjectID: "typed-project",
 				Profile:      "deprecated-project",
 			},
@@ -230,14 +230,14 @@ func TestNewProvider_ProjectIDResolution(t *testing.T) {
 		},
 		{
 			name: "Typed GCPProjectID alone (no Profile fallback needed)",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				GCPProjectID: "only-typed",
 			},
 			expected: "only-typed",
 		},
 		{
 			name: "Deprecated Profile is honored when typed field is empty",
-			config: &provider.ProviderConfig{
+			config: &provider.Config{
 				Profile: "legacy-project",
 			},
 			expected: "legacy-project",
@@ -249,7 +249,7 @@ func TestNewProvider_ProjectIDResolution(t *testing.T) {
 		},
 		{
 			name:     "Empty config resolves to empty (caller falls through to ADC)",
-			config:   &provider.ProviderConfig{},
+			config:   &provider.Config{},
 			expected: "",
 		},
 	}
@@ -402,7 +402,7 @@ func TestGCPProvider_GetServiceClient_RelationalDB(t *testing.T) {
 func TestNewProvider_WithConfig(t *testing.T) {
 	t.Parallel()
 	// Test NewProvider with a config containing a project ID
-	config := &provider.ProviderConfig{
+	config := &provider.Config{
 		Profile: "test-project-id",
 	}