[Unit]
Description=Daily t3 pinned-version enforcer (re-asserts T3_PIN; no-op when correct)

[Timer]
OnCalendar=*-*-* 04:00:00
RandomizedDelaySec=1h
Persistent=true

[Install]
WantedBy=timers.target