diff --git a/modules/aws/agentic-coding-sandbox/buildingblock/README.md b/modules/aws/agentic-coding-sandbox/buildingblock/README.md
index 39f3df466..396370364 100644
--- a/modules/aws/agentic-coding-sandbox/buildingblock/README.md
+++ b/modules/aws/agentic-coding-sandbox/buildingblock/README.md
@@ -77,7 +77,7 @@ End users provide:
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.7.1 |
+| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.27.0 |
 
 ## Modules
 
@@ -87,11 +87,14 @@ No modules.
 
 | Name | Type |
 |------|------|
-| [meshstack_buildingblock.budget_alert](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/buildingblock) | resource |
-| [meshstack_buildingblock.enable_eu_south_2_region](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/buildingblock) | resource |
+| [meshstack_building_block.budget_alert](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block) | resource |
+| [meshstack_building_block.enable_eu_south_2_region](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/building_block) | resource |
 | [meshstack_project.sandbox](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/project) | resource |
 | [meshstack_tenant.sandbox](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/resources/tenant) | resource |
 | [random_string.suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
+| [meshstack_building_block_definitions.composed](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/data-sources/building_block_definitions) | data source |
+| [meshstack_landingzone.sandbox](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/data-sources/landingzone) | data source |
+| [meshstack_platforms.sandbox](https://registry.terraform.io/providers/meshcloud/meshstack/latest/docs/data-sources/platforms) | data source |
 
 ## Inputs
 
diff --git a/modules/aws/agentic-coding-sandbox/buildingblock/main.tf b/modules/aws/agentic-coding-sandbox/buildingblock/main.tf
index 84a08438d..4539d94ee 100644
--- a/modules/aws/agentic-coding-sandbox/buildingblock/main.tf
+++ b/modules/aws/agentic-coding-sandbox/buildingblock/main.tf
@@ -64,64 +64,99 @@ resource "meshstack_project" "sandbox" {
 }
 
 
+data "meshstack_platforms" "sandbox" {
+  identifier = local.platform_identifier
+}
+
+data "meshstack_landingzone" "sandbox" {
+  metadata = {
+    name = local.landing_zone_identifier
+  }
+}
+
 resource "meshstack_tenant" "sandbox" {
   metadata = {
-    owned_by_workspace  = meshstack_project.sandbox.metadata.owned_by_workspace
-    owned_by_project    = meshstack_project.sandbox.metadata.name
-    platform_identifier = local.platform_identifier
+    owned_by_workspace = meshstack_project.sandbox.metadata.owned_by_workspace
+    owned_by_project   = meshstack_project.sandbox.metadata.name
   }
 
   spec = {
-    landing_zone_identifier = local.landing_zone_identifier
+    platform_ref     = one(data.meshstack_platforms.sandbox.platforms).ref
+    landing_zone_ref = data.meshstack_landingzone.sandbox.ref
   }
 }
 
+data "meshstack_building_block_definitions" "composed" {
+  uuids = [local.budget_alert_definition_uuid, local.enable_eu_south_2_region_definition_uuid]
+}
 
-# NOTE: must use bb v1 resource because v2 requires a tenant uuid
-# but the tenant v4 api that delivers the uuid is not supported by  our terraform provider yet
-resource "meshstack_buildingblock" "budget_alert" {
-  metadata = {
-    definition_uuid    = local.budget_alert_definition_uuid
-    definition_version = local.budget_alert_definition_version
-    tenant_identifier  = "${meshstack_tenant.sandbox.metadata.owned_by_workspace}.${meshstack_tenant.sandbox.metadata.owned_by_project}.${meshstack_tenant.sandbox.metadata.platform_identifier}"
+locals {
+  definition_versions = {
+    for definition in data.meshstack_building_block_definitions.composed.building_block_definitions :
+    definition.metadata.uuid => { for version in definition.versions : version.number => { uuid = version.uuid } }
   }
+}
 
+moved {
+  from = meshstack_buildingblock.budget_alert
+  to   = meshstack_building_block.budget_alert
+}
+
+resource "meshstack_building_block" "budget_alert" {
   spec = {
+    building_block_definition_version_ref = local.definition_versions[local.budget_alert_definition_uuid][local.budget_alert_definition_version]
+
     display_name = "Budget Alert"
+    target_ref   = meshstack_tenant.sandbox.ref
 
     inputs = {
       budget_name = {
-        value_string = "Agentic Coding Budget Alert"
+        value = jsonencode("Agentic Coding Budget Alert")
       }
       monthly_budget_amount = {
-        value_int = var.budget_amount
+        value = jsonencode(var.budget_amount)
       }
       contact_emails = {
         # just a single email for now, not a comma-separated list
-        value_string = var.username
+        value = jsonencode(var.username)
       }
     }
   }
+
+  lifecycle {
+    postcondition {
+      condition     = self.status.succeeded
+      error_message = "Building block ${self.metadata.uuid} did not succeed (health status ${self.status.health_status}, action ${self.status.action}). See its run in meshPanel."
+    }
+  }
 }
 
+moved {
+  from = meshstack_buildingblock.enable_eu_south_2_region
+  to   = meshstack_building_block.enable_eu_south_2_region
+}
 
 # enable spain region for the sandbox tenant because that's the only region where Anthropic's Sonnet 4 is available
-resource "meshstack_buildingblock" "enable_eu_south_2_region" {
-  metadata = {
-    definition_uuid    = local.enable_eu_south_2_region_definition_uuid
-    definition_version = local.enable_eu_south_2_region_definition_version
-    tenant_identifier  = "${meshstack_tenant.sandbox.metadata.owned_by_workspace}.${meshstack_tenant.sandbox.metadata.owned_by_project}.${meshstack_tenant.sandbox.metadata.platform_identifier}"
-  }
-
+resource "meshstack_building_block" "enable_eu_south_2_region" {
   spec = {
+    building_block_definition_version_ref = local.definition_versions[local.enable_eu_south_2_region_definition_uuid][local.enable_eu_south_2_region_definition_version]
+
     display_name = "Enable eu-south-2 region"
+    target_ref   = meshstack_tenant.sandbox.ref
 
     inputs = {
       region = {
-        value_single_select = "eu-south-2"
+        value = jsonencode("eu-south-2")
       }
     }
   }
+
+  lifecycle {
+    postcondition {
+      condition     = self.status.succeeded
+      error_message = "Building block ${self.metadata.uuid} did not succeed (health status ${self.status.health_status}, action ${self.status.action}). See its run in meshPanel."
+    }
+  }
 }
 
 # note: this does not work until API keys get support for an ADM level permission on project role bidnings
diff --git a/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf b/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf
index 0cc33709a..8aa18d8a1 100644
--- a/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf
+++ b/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.7.1"
+      version = ">= 0.27.0"
     }
   }
 }
\ No newline at end of file
diff --git a/reference-architectures/otc-landingzone/buildingblock/main.tf b/reference-architectures/otc-landingzone/buildingblock/main.tf
index 256ba8822..0131f30c6 100644
--- a/reference-architectures/otc-landingzone/buildingblock/main.tf
+++ b/reference-architectures/otc-landingzone/buildingblock/main.tf
@@ -190,8 +190,8 @@ resource "meshstack_building_block" "federation_mapping" {
     enabled = local.federation_enabled
 
     postcondition {
-      condition     = self.status.status == "SUCCEEDED"
-      error_message = "Building block ${self.metadata.uuid} is ${self.status.status}, not SUCCEEDED. See its run in meshPanel."
+      condition     = self.status.succeeded
+      error_message = "Building block ${self.metadata.uuid} did not succeed (health status ${self.status.health_status}, action ${self.status.action}). See its run in meshPanel."
     }
   }
 
diff --git a/reference-architectures/otc-landingzone/buildingblock/versions.tf b/reference-architectures/otc-landingzone/buildingblock/versions.tf
index 49920bd18..9b536b825 100644
--- a/reference-architectures/otc-landingzone/buildingblock/versions.tf
+++ b/reference-architectures/otc-landingzone/buildingblock/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.26.4" # meshstack_platform_type
+      version = ">= 0.27.0" # status.succeeded
     }
     opentelekomcloud = {
       source  = "opentelekomcloud/opentelekomcloud"