gov is idempotent. repeated run will update third-parties