A Jenkins 8,793 controller holds deploy keys and registry passwords, and runs code from every branch it builds, so an attacker who reaches it usually reaches production too. This section hardens the lane's controller, l2-jenkins, layer by layer: who may log in, what each person may do, where secrets live, what Pipeline code may call, and how to keep up with advisories.