tweak refs to `{#secureHash}` because that's not quite right anymore