---
title: "1.24.11 — Deployment-complete MojoSec identity proof"
description: "django-mojo 1.24.11 makes ordinary enrolled deployments fully converge MojoSec from the activated framework before firewall work, so newly shipped identity-helper assets actually reach hosts. It also persists a protected Yama ptrace policy without weakening stricter host settings. No migrations or c…"
date: "2026-09-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-11/"
---

django-mojo 1.24.11 makes ordinary enrolled deployments fully converge MojoSec from the activated framework before firewall work, so newly shipped identity-helper assets actually reach hosts. It also persists a protected Yama ptrace policy without weakening stricter host settings. No migrations or consumer code changes are required.

### Fixed

- Ordinary candidate and previous-version activations now fully converge enrolled MojoSec assets before firewall reconciliation, instead of only restarting the existing sensor unit.
- Deployment identity is carried into trusted-change evidence, while observer degradation remains non-blocking to application rollout.

### Security

- Observe convergence persists `kernel.yama.ptrace_scope >= 1`, raises weak live policy immediately, and never lowers an existing value of `2` or `3`.
- Managed sysctl content and metadata are replaced atomically, symlinks are refused, and failed convergence restores the prior file and live kernel value.
- Node checks now verify that live and persistent ptrace protection agree exactly.

### Upgrade notes

- Enrolled hosts adopt the helper units and managed kernel policy automatically on their next normal deployment.
- Mode-off removes the package-owned persistent setting after retiring the helper, without weakening the current live kernel value.