diff --git a/modules/agent-box.nix b/modules/agent-box.nix
index 3365d12c..ba4d8526 100644
--- a/modules/agent-box.nix
+++ b/modules/agent-box.nix
@@ -1637,8 +1637,8 @@ let
 # module-generated-up-to-date check fails until it matches.
 {
   repo = "defangdevs/local-channels";
-  rev = "2be2185cbc196aaaa88cef1d9da0292d94ba7243";
-  sha256 = "sha256-N95IhtnjXXqt5WB5wq0pISAsXwxmAFLI/zafl/J4aPU=";
+  rev = "17c457ac57258c5a8b96c667eedaec95ad8c35e8";
+  sha256 = "sha256-JH5ouvviN2UWRS89bGn1aUXUIwtUAQ6uPo1xX8nQCD8=";
 }
   ;
   localWebhookScript = builtins.fetchurl {
diff --git a/nix/webhook-pin.nix b/nix/webhook-pin.nix
index 33a0be34..e97c9da4 100644
--- a/nix/webhook-pin.nix
+++ b/nix/webhook-pin.nix
@@ -16,6 +16,6 @@
 # module-generated-up-to-date check fails until it matches.
 {
   repo = "defangdevs/local-channels";
-  rev = "2be2185cbc196aaaa88cef1d9da0292d94ba7243";
-  sha256 = "sha256-N95IhtnjXXqt5WB5wq0pISAsXwxmAFLI/zafl/J4aPU=";
+  rev = "17c457ac57258c5a8b96c667eedaec95ad8c35e8";
+  sha256 = "sha256-JH5ouvviN2UWRS89bGn1aUXUIwtUAQ6uPo1xX8nQCD8=";
 }
diff --git a/tests/webhook.nix b/tests/webhook.nix
index f9ce7788..60bc0524 100644
--- a/tests/webhook.nix
+++ b/tests/webhook.nix
@@ -526,6 +526,10 @@
         " -H 'content-type: application/json' -H 'x-github-event: workflow_run'"
         " -H 'x-github-delivery: test-1' --data-binary @/tmp/body.json"
     )
+    # 0.33.0 drops a re-sent delivery id, so a later post that must be
+    # processed again needs an id of its own.
+    ids = iter(range(100))
+    fresh = lambda: post.replace("test-1", "test-1-%d" % next(ids))  # noqa: E731
     # Wrong signature and no signature are both refused, before any parsing.
     client.succeed(
         f"{post} -H 'x-hub-signature-256: sha256=00' "
@@ -617,7 +621,7 @@
     # sessions on one PR. The suppression is logged, because a silently skipped
     # spawn is indistinguishable from a watch that stopped working (#170).
     client.succeed(
-        f"{post} -H 'x-hub-signature-256: sha256={sig}' "
+        f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' "
         f"https://box.test/agent/webhook/github | grep -x 200"
     )
     machine.wait_until_succeeds(
@@ -693,7 +697,7 @@
     # restarting it afterwards proves the spawn + consumption half.
     machine.succeed("systemctl stop agent-box@agent.service")
     client.succeed(
-        f"{post} -H 'x-hub-signature-256: sha256={sig}' "
+        f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' "
         f"https://box.test/agent/webhook/github | grep -x 200"
     )
     machine.wait_until_succeeds(
@@ -865,7 +869,7 @@
         timeout=30,
     )
     client.succeed(
-        f"{post} -H 'x-hub-signature-256: sha256={sig}' "
+        f"{fresh()} -H 'x-hub-signature-256: sha256={sig}' "
         f"https://box.test/agent/webhook/github | grep -x 200"
     )
     # The named suppression is the primary evidence: had the brake missed, the