From 42da4797bc36d4c9771e56025ed15a0c007f2d75 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Fri, 14 Nov 2025 17:03:20 +0000
Subject: [PATCH 01/11] CCM-12744: WIP

---
 .../__snapshots__/page.test.tsx.snap          |  24 ++
 .../app/choose-templates/page.test.tsx        |   1 +
 .../__snapshots__/page.test.tsx.snap          |  24 ++
 .../edit-message-plan-settings/page.test.tsx  |  24 +-
 .../__tests__/app/message-plans/page.test.tsx |   1 +
 .../molecules/MessagePlanBlock.test.tsx       |   8 +
 .../MessagePlanChannelTemplate.test.tsx       |   6 +
 .../MessagePlanBlock.test.tsx.snap            |  32 +++
 .../MessagePlanChannelTemplate.test.tsx.snap  |  32 +++
 .../organisms/CreateEditMessagePlan.test.tsx  |   1 +
 .../organisms/MessagePlanChannelList.test.tsx |   1 +
 .../CreateEditMessagePlan.test.tsx.snap       |  24 ++
 .../MessagePlanChannelList.test.tsx.snap      |  48 ++++
 .../PreviewLetterTemplate.test.tsx.snap       |  10 +-
 .../helpers/routing-config-factory.ts         |   1 +
 .../get-message-plan-template-ids.test.ts     |  18 +-
 .../src/__tests__/utils/message-plans.test.ts |  31 ++-
 .../[routingConfigId]/actions.test.ts         |   1 +
 .../[routingConfigId]/actions.ts              |   8 +-
 .../[routingConfigId]/page.tsx                |   6 +
 .../[routingConfigId]/server-action.ts        |  14 +-
 .../[templateId]/page.tsx                     |  14 +-
 .../[templateId]/page.tsx                     |  14 +-
 .../MessagePlanBlock/MessagePlanBlock.tsx     |   3 +
 .../MessagePlanChannelTemplate.tsx            |  16 +-
 .../MessagePlanChannelList.tsx                |   1 +
 .../PreviewLetterTemplate.tsx                 |   6 +-
 .../utils/get-message-plan-template-ids.ts    |   2 +-
 frontend/src/utils/message-plans.ts           |   8 +-
 .../modules/backend-api/spec.tmpl.json        |  33 ++-
 .../api/create-routing-config.test.ts         |   1 +
 .../api/delete-routing-config.test.ts         |  56 +++-
 .../src/__tests__/api/delete.test.ts          |  11 +-
 .../src/__tests__/api/proof.test.ts           |   6 +-
 .../api/submit-routing-config.test.ts         |  56 +++-
 .../src/__tests__/api/submit.test.ts          |   6 +-
 .../api/update-routing-config.test.ts         |  68 ++++-
 .../src/__tests__/api/update.test.ts          |  11 +-
 .../app/routing-config-client.test.ts         | 123 ++++++--
 .../src/__tests__/app/template-client.test.ts |  12 +-
 .../src/__tests__/fixtures/routing-config.ts  |   1 +
 .../repository.test.ts                        | 227 ++++++++++++---
 .../infra/template-repository.test.ts         |  14 +-
 .../src/api/delete-routing-config.ts          |   3 +-
 .../src/api/submit-routing-config.ts          |   3 +-
 .../src/api/update-routing-config.ts          |   3 +-
 .../src/app/routing-config-client.ts          |  49 +++-
 .../backend-api/src/app/template-client.ts    |  20 +-
 .../routing-config-repository/repository.ts   |  45 ++-
 .../src/infra/template-repository.ts          |  24 +-
 .../routing-config-api-client.test.ts         |  11 +-
 .../src/routing-config-api-client.ts          |  11 +-
 .../src/schemas/routing-config.ts             |   8 +-
 .../src/schemas/template-schema.ts            |   4 +-
 .../src/types/generated/types.gen.ts          |  33 ++-
 .../factories/routing-config-factory.ts       |   1 +
 .../create-routing-configuration.api.spec.ts  |   2 +
 .../delete-routing-config.api.spec.ts         | 134 ++++++---
 .../delete-template.api.spec.ts               |   6 +-
 .../request-proof.api.spec.ts                 |   6 +-
 .../submit-routing-config.api.spec.ts         | 150 +++++++---
 .../submit-template.api.spec.ts               |   6 +-
 .../update-routing-config.api.spec.ts         | 262 ++++++++++++------
 .../update-template.api.spec.ts               |   6 +-
 .../routing-config-update-builder.test.ts     |  58 ++++
 .../src/routing-config-update-builder.ts      |  15 +
 utils/utils/src/types.ts                      |   1 +
 67 files changed, 1501 insertions(+), 364 deletions(-)

diff --git a/frontend/src/__tests__/app/choose-templates/__snapshots__/page.test.tsx.snap b/frontend/src/__tests__/app/choose-templates/__snapshots__/page.test.tsx.snap
index 0a3996d36..30df80b18 100644
--- a/frontend/src/__tests__/app/choose-templates/__snapshots__/page.test.tsx.snap
+++ b/frontend/src/__tests__/app/choose-templates/__snapshots__/page.test.tsx.snap
@@ -127,14 +127,22 @@ exports[`ChooseTemplatesPage renders correctly for a message plan with multiple
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="NHSAPP"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="fbb81055-79b9-4759-ac07-d191ae57be34"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-NHSAPP"
@@ -300,14 +308,22 @@ exports[`ChooseTemplatesPage renders correctly for a message plan with multiple
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="SMS"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="fbb81055-79b9-4759-ac07-d191ae57be34"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-SMS"
@@ -611,14 +627,22 @@ exports[`ChooseTemplatesPage renders correctly for a message plan with multiple
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="LETTER"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="fbb81055-79b9-4759-ac07-d191ae57be34"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-LETTER"
diff --git a/frontend/src/__tests__/app/choose-templates/page.test.tsx b/frontend/src/__tests__/app/choose-templates/page.test.tsx
index 02c0504c1..d9a9190f5 100644
--- a/frontend/src/__tests__/app/choose-templates/page.test.tsx
+++ b/frontend/src/__tests__/app/choose-templates/page.test.tsx
@@ -41,6 +41,7 @@ const routingConfig: RoutingConfig = {
   updatedAt: '2025-01-13T10:19:25.579Z',
   cascadeGroupOverrides: [],
   cascade: [],
+  lockNumber: 0,
 };
 
 describe('ChooseTemplatesPage', () => {
diff --git a/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/__snapshots__/page.test.tsx.snap b/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/__snapshots__/page.test.tsx.snap
index 20855e7d4..91de8b53c 100644
--- a/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/__snapshots__/page.test.tsx.snap
+++ b/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/__snapshots__/page.test.tsx.snap
@@ -168,6 +168,12 @@ exports[`multiple campaigns matches snapshot 1`] = `
             type="hidden"
             value="d7afdc99-d55b-4f26-8442-2d10aea07346"
           />
+          <input
+            name="lockNumber"
+            readonly=""
+            type="hidden"
+            value="0"
+          />
         </form>
       </div>
     </div>
@@ -398,6 +404,12 @@ exports[`multiple campaigns renders errors when form is submitted in invalid sta
             type="hidden"
             value="d7afdc99-d55b-4f26-8442-2d10aea07346"
           />
+          <input
+            name="lockNumber"
+            readonly=""
+            type="hidden"
+            value="0"
+          />
         </form>
       </div>
     </div>
@@ -558,6 +570,12 @@ exports[`single campaign matches snapshot 1`] = `
             type="hidden"
             value="d7afdc99-d55b-4f26-8442-2d10aea07346"
           />
+          <input
+            name="lockNumber"
+            readonly=""
+            type="hidden"
+            value="0"
+          />
         </form>
       </div>
     </div>
@@ -755,6 +773,12 @@ exports[`single campaign renders errors when form is submitted in invalid state
             type="hidden"
             value="d7afdc99-d55b-4f26-8442-2d10aea07346"
           />
+          <input
+            name="lockNumber"
+            readonly=""
+            type="hidden"
+            value="0"
+          />
         </form>
       </div>
     </div>
diff --git a/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/page.test.tsx b/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/page.test.tsx
index eb80ab685..35a84fd9a 100644
--- a/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/page.test.tsx
+++ b/frontend/src/__tests__/app/message-plans/edit-message-plan-settings/page.test.tsx
@@ -148,10 +148,14 @@ describe('single campaign', () => {
 
     await user.click(await screen.findByTestId('submit-button'));
 
-    expect(updateRoutingConfig).toHaveBeenCalledWith(routingConfig.id, {
-      name: 'New Name',
-      campaignId: routingConfig.campaignId,
-    });
+    expect(updateRoutingConfig).toHaveBeenCalledWith(
+      routingConfig.id,
+      {
+        name: 'New Name',
+        campaignId: routingConfig.campaignId,
+      },
+      routingConfig.lockNumber
+    );
 
     expect(redirect).toHaveBeenCalledWith(
       `/message-plans/choose-templates/${routingConfig.id}`,
@@ -251,10 +255,14 @@ describe('multiple campaigns', () => {
 
     await user.click(await screen.findByTestId('submit-button'));
 
-    expect(updateRoutingConfig).toHaveBeenCalledWith(routingConfig.id, {
-      name: 'New Name',
-      campaignId: alternateCampaignId,
-    });
+    expect(updateRoutingConfig).toHaveBeenCalledWith(
+      routingConfig.id,
+      {
+        name: 'New Name',
+        campaignId: alternateCampaignId,
+      },
+      routingConfig.lockNumber
+    );
 
     expect(redirect).toHaveBeenCalledWith(
       `/message-plans/choose-templates/${routingConfig.id}`,
diff --git a/frontend/src/__tests__/app/message-plans/page.test.tsx b/frontend/src/__tests__/app/message-plans/page.test.tsx
index 48c1c3a5f..d3079c98d 100644
--- a/frontend/src/__tests__/app/message-plans/page.test.tsx
+++ b/frontend/src/__tests__/app/message-plans/page.test.tsx
@@ -28,6 +28,7 @@ const buildRoutingConfig = (rc: Partial<RoutingConfig>): RoutingConfig => ({
   id: '',
   name: '',
   updatedAt: '',
+  lockNumber: 0,
   ...rc,
 });
 
diff --git a/frontend/src/__tests__/components/molecules/MessagePlanBlock.test.tsx b/frontend/src/__tests__/components/molecules/MessagePlanBlock.test.tsx
index f6e5b643a..7bdb3eb8b 100644
--- a/frontend/src/__tests__/components/molecules/MessagePlanBlock.test.tsx
+++ b/frontend/src/__tests__/components/molecules/MessagePlanBlock.test.tsx
@@ -28,6 +28,7 @@ describe('MessagePlanBlock', () => {
         index={0}
         channelItem={channelItem}
         routingConfigId='test-routing-config-id'
+        lockNumber={42}
       />
     );
 
@@ -47,6 +48,7 @@ describe('MessagePlanBlock', () => {
         index={2}
         channelItem={channelItem}
         routingConfigId='test-routing-config-id'
+        lockNumber={42}
       />
     );
 
@@ -65,6 +67,7 @@ describe('MessagePlanBlock', () => {
         index={0}
         channelItem={channelItem}
         routingConfigId='test-routing-config-id'
+        lockNumber={42}
       />
     );
 
@@ -83,6 +86,7 @@ describe('MessagePlanBlock', () => {
           channelItem={channelItem}
           template={mockTemplate}
           routingConfigId='test-routing-config-id'
+          lockNumber={42}
         />
       );
       expect(screen.getByText('Test email template')).toBeInTheDocument();
@@ -97,6 +101,7 @@ describe('MessagePlanBlock', () => {
           channelItem={channelItem}
           template={mockTemplate}
           routingConfigId='test-routing-config-id'
+          lockNumber={42}
         />
       );
 
@@ -121,6 +126,7 @@ describe('MessagePlanBlock', () => {
           index={0}
           channelItem={channelItem}
           routingConfigId='test-routing-config-id'
+          lockNumber={42}
         />
       );
 
@@ -151,6 +157,7 @@ describe('MessagePlanBlock', () => {
             channelItem={channelItem}
             template={mockTemplate}
             routingConfigId='test-routing-config-id'
+            lockNumber={42}
           />
         );
         expect(asFragment()).toMatchSnapshot();
@@ -168,6 +175,7 @@ describe('MessagePlanBlock', () => {
             index={0}
             channelItem={channelItem}
             routingConfigId='test-routing-config-id'
+            lockNumber={42}
           />
         );
         expect(asFragment()).toMatchSnapshot();
diff --git a/frontend/src/__tests__/components/molecules/MessagePlanChannelTemplate.test.tsx b/frontend/src/__tests__/components/molecules/MessagePlanChannelTemplate.test.tsx
index 8f6cfad93..7ce2980f0 100644
--- a/frontend/src/__tests__/components/molecules/MessagePlanChannelTemplate.test.tsx
+++ b/frontend/src/__tests__/components/molecules/MessagePlanChannelTemplate.test.tsx
@@ -10,6 +10,7 @@ describe('MessagePlanChannelTemplate', () => {
       <MessagePlanChannelTemplate
         channel='EMAIL'
         routingConfigId={routingConfigId}
+        lockNumber={42}
       />
     );
 
@@ -25,6 +26,7 @@ describe('MessagePlanChannelTemplate', () => {
           channel='LETTER'
           required={false}
           routingConfigId={routingConfigId}
+          lockNumber={42}
         />
       );
     });
@@ -42,6 +44,7 @@ describe('MessagePlanChannelTemplate', () => {
         <MessagePlanChannelTemplate
           channel='NHSAPP'
           routingConfigId={routingConfigId}
+          lockNumber={42}
         />
       );
     });
@@ -78,6 +81,7 @@ describe('MessagePlanChannelTemplate', () => {
           channel='SMS'
           template={testTemplate}
           routingConfigId={routingConfigId}
+          lockNumber={42}
         />
       );
     });
@@ -131,6 +135,7 @@ describe('MessagePlanChannelTemplate', () => {
         <MessagePlanChannelTemplate
           channel={channel}
           routingConfigId={routingConfigId}
+          lockNumber={42}
         />
       );
 
@@ -151,6 +156,7 @@ describe('MessagePlanChannelTemplate', () => {
           channel={channel}
           template={testTemplate}
           routingConfigId={routingConfigId}
+          lockNumber={42}
         />
       );
       expect(container).toMatchSnapshot();
diff --git a/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanBlock.test.tsx.snap b/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanBlock.test.tsx.snap
index 2e6ad30b9..a8ded6e59 100644
--- a/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanBlock.test.tsx.snap
+++ b/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanBlock.test.tsx.snap
@@ -109,14 +109,22 @@ exports[`MessagePlanBlock for channel EMAIL with template should match snapshot
             <form>
               <input
                 name="channel"
+                readonly=""
                 type="hidden"
                 value="EMAIL"
               />
               <input
                 name="routingConfigId"
+                readonly=""
                 type="hidden"
                 value="test-routing-config-id"
               />
+              <input
+                name="lockNumber"
+                readonly=""
+                type="hidden"
+                value="42"
+              />
               <button
                 class="channel-template-link--remove nhsuk-link"
                 data-testid="remove-template-link-EMAIL"
@@ -249,14 +257,22 @@ exports[`MessagePlanBlock for channel LETTER with template should match snapshot
             <form>
               <input
                 name="channel"
+                readonly=""
                 type="hidden"
                 value="LETTER"
               />
               <input
                 name="routingConfigId"
+                readonly=""
                 type="hidden"
                 value="test-routing-config-id"
               />
+              <input
+                name="lockNumber"
+                readonly=""
+                type="hidden"
+                value="42"
+              />
               <button
                 class="channel-template-link--remove nhsuk-link"
                 data-testid="remove-template-link-LETTER"
@@ -389,14 +405,22 @@ exports[`MessagePlanBlock for channel NHSAPP with template should match snapshot
             <form>
               <input
                 name="channel"
+                readonly=""
                 type="hidden"
                 value="NHSAPP"
               />
               <input
                 name="routingConfigId"
+                readonly=""
                 type="hidden"
                 value="test-routing-config-id"
               />
+              <input
+                name="lockNumber"
+                readonly=""
+                type="hidden"
+                value="42"
+              />
               <button
                 class="channel-template-link--remove nhsuk-link"
                 data-testid="remove-template-link-NHSAPP"
@@ -529,14 +553,22 @@ exports[`MessagePlanBlock for channel SMS with template should match snapshot 1`
             <form>
               <input
                 name="channel"
+                readonly=""
                 type="hidden"
                 value="SMS"
               />
               <input
                 name="routingConfigId"
+                readonly=""
                 type="hidden"
                 value="test-routing-config-id"
               />
+              <input
+                name="lockNumber"
+                readonly=""
+                type="hidden"
+                value="42"
+              />
               <button
                 class="channel-template-link--remove nhsuk-link"
                 data-testid="remove-template-link-SMS"
diff --git a/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanChannelTemplate.test.tsx.snap b/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanChannelTemplate.test.tsx.snap
index b78daea5d..43c9ef2a9 100644
--- a/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanChannelTemplate.test.tsx.snap
+++ b/frontend/src/__tests__/components/molecules/__snapshots__/MessagePlanChannelTemplate.test.tsx.snap
@@ -194,14 +194,22 @@ exports[`MessagePlanChannelTemplate should match snapshot for selected template
           <form>
             <input
               name="channel"
+              readonly=""
               type="hidden"
               value="EMAIL"
             />
             <input
               name="routingConfigId"
+              readonly=""
               type="hidden"
               value="test-routing-config-id"
             />
+            <input
+              name="lockNumber"
+              readonly=""
+              type="hidden"
+              value="42"
+            />
             <button
               class="channel-template-link--remove nhsuk-link"
               data-testid="remove-template-link-EMAIL"
@@ -267,14 +275,22 @@ exports[`MessagePlanChannelTemplate should match snapshot for selected template
           <form>
             <input
               name="channel"
+              readonly=""
               type="hidden"
               value="LETTER"
             />
             <input
               name="routingConfigId"
+              readonly=""
               type="hidden"
               value="test-routing-config-id"
             />
+            <input
+              name="lockNumber"
+              readonly=""
+              type="hidden"
+              value="42"
+            />
             <button
               class="channel-template-link--remove nhsuk-link"
               data-testid="remove-template-link-LETTER"
@@ -340,14 +356,22 @@ exports[`MessagePlanChannelTemplate should match snapshot for selected template
           <form>
             <input
               name="channel"
+              readonly=""
               type="hidden"
               value="NHSAPP"
             />
             <input
               name="routingConfigId"
+              readonly=""
               type="hidden"
               value="test-routing-config-id"
             />
+            <input
+              name="lockNumber"
+              readonly=""
+              type="hidden"
+              value="42"
+            />
             <button
               class="channel-template-link--remove nhsuk-link"
               data-testid="remove-template-link-NHSAPP"
@@ -413,14 +437,22 @@ exports[`MessagePlanChannelTemplate should match snapshot for selected template
           <form>
             <input
               name="channel"
+              readonly=""
               type="hidden"
               value="SMS"
             />
             <input
               name="routingConfigId"
+              readonly=""
               type="hidden"
               value="test-routing-config-id"
             />
+            <input
+              name="lockNumber"
+              readonly=""
+              type="hidden"
+              value="42"
+            />
             <button
               class="channel-template-link--remove nhsuk-link"
               data-testid="remove-template-link-SMS"
diff --git a/frontend/src/__tests__/components/organisms/CreateEditMessagePlan.test.tsx b/frontend/src/__tests__/components/organisms/CreateEditMessagePlan.test.tsx
index aab1a9272..3c47863a3 100644
--- a/frontend/src/__tests__/components/organisms/CreateEditMessagePlan.test.tsx
+++ b/frontend/src/__tests__/components/organisms/CreateEditMessagePlan.test.tsx
@@ -37,6 +37,7 @@ function buildRoutingConfig({
       channelType: 'primary',
       defaultTemplateId: `template-${index}`,
     })),
+    lockNumber: 0,
   };
 }
 
diff --git a/frontend/src/__tests__/components/organisms/MessagePlanChannelList.test.tsx b/frontend/src/__tests__/components/organisms/MessagePlanChannelList.test.tsx
index 3ab117f61..608fea920 100644
--- a/frontend/src/__tests__/components/organisms/MessagePlanChannelList.test.tsx
+++ b/frontend/src/__tests__/components/organisms/MessagePlanChannelList.test.tsx
@@ -25,6 +25,7 @@ function buildRoutingConfig(channels: Channel[]): RoutingConfig {
       channelType: 'primary',
       defaultTemplateId: `test-template-${i}`,
     })),
+    lockNumber: 0,
   };
 }
 
diff --git a/frontend/src/__tests__/components/organisms/__snapshots__/CreateEditMessagePlan.test.tsx.snap b/frontend/src/__tests__/components/organisms/__snapshots__/CreateEditMessagePlan.test.tsx.snap
index ad8fbfad9..4628870c5 100644
--- a/frontend/src/__tests__/components/organisms/__snapshots__/CreateEditMessagePlan.test.tsx.snap
+++ b/frontend/src/__tests__/components/organisms/__snapshots__/CreateEditMessagePlan.test.tsx.snap
@@ -689,14 +689,22 @@ exports[`CreateEditMessagePlan should match snapshot for a typical message plan
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="NHSAPP"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="30fd1e1c-a608-47cf-9cc2-eabaeeeebeca"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-NHSAPP"
@@ -860,14 +868,22 @@ exports[`CreateEditMessagePlan should match snapshot for a typical message plan
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="EMAIL"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="30fd1e1c-a608-47cf-9cc2-eabaeeeebeca"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-EMAIL"
@@ -1031,14 +1047,22 @@ exports[`CreateEditMessagePlan should match snapshot for a typical message plan
                     <form>
                       <input
                         name="channel"
+                        readonly=""
                         type="hidden"
                         value="LETTER"
                       />
                       <input
                         name="routingConfigId"
+                        readonly=""
                         type="hidden"
                         value="30fd1e1c-a608-47cf-9cc2-eabaeeeebeca"
                       />
+                      <input
+                        name="lockNumber"
+                        readonly=""
+                        type="hidden"
+                        value="0"
+                      />
                       <button
                         class="channel-template-link--remove nhsuk-link"
                         data-testid="remove-template-link-LETTER"
diff --git a/frontend/src/__tests__/components/organisms/__snapshots__/MessagePlanChannelList.test.tsx.snap b/frontend/src/__tests__/components/organisms/__snapshots__/MessagePlanChannelList.test.tsx.snap
index 6e45d1098..3919637f3 100644
--- a/frontend/src/__tests__/components/organisms/__snapshots__/MessagePlanChannelList.test.tsx.snap
+++ b/frontend/src/__tests__/components/organisms/__snapshots__/MessagePlanChannelList.test.tsx.snap
@@ -59,14 +59,22 @@ exports[`MessagePlanChannelList should match snapshot for a digital routing plan
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="NHSAPP"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-NHSAPP"
@@ -230,14 +238,22 @@ exports[`MessagePlanChannelList should match snapshot for a digital routing plan
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="EMAIL"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-EMAIL"
@@ -401,14 +417,22 @@ exports[`MessagePlanChannelList should match snapshot for a digital routing plan
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="SMS"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-SMS"
@@ -492,14 +516,22 @@ exports[`MessagePlanChannelList should match snapshot for a routing plan with a
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="NHSAPP"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-NHSAPP"
@@ -663,14 +695,22 @@ exports[`MessagePlanChannelList should match snapshot for a routing plan with a
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="EMAIL"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-EMAIL"
@@ -834,14 +874,22 @@ exports[`MessagePlanChannelList should match snapshot for a routing plan with a
               <form>
                 <input
                   name="channel"
+                  readonly=""
                   type="hidden"
                   value="LETTER"
                 />
                 <input
                   name="routingConfigId"
+                  readonly=""
                   type="hidden"
                   value="routingconfig-1"
                 />
+                <input
+                  name="lockNumber"
+                  readonly=""
+                  type="hidden"
+                  value="0"
+                />
                 <button
                   class="channel-template-link--remove nhsuk-link"
                   data-testid="remove-template-link-LETTER"
diff --git a/frontend/src/__tests__/components/organisms/__snapshots__/PreviewLetterTemplate.test.tsx.snap b/frontend/src/__tests__/components/organisms/__snapshots__/PreviewLetterTemplate.test.tsx.snap
index 53237a5d6..c65d0e7ba 100644
--- a/frontend/src/__tests__/components/organisms/__snapshots__/PreviewLetterTemplate.test.tsx.snap
+++ b/frontend/src/__tests__/components/organisms/__snapshots__/PreviewLetterTemplate.test.tsx.snap
@@ -163,7 +163,7 @@ exports[`PreviewLetterTemplate component matches snapshot when template language
           class="nhsuk-button"
           data-testid="preview-letter-template-cta"
           draggable="false"
-          href="/templates/submit-letter-template/0A097DCD-35F9-4DAD-A37E-AC358B71B74D"
+          href="/templates/submit-letter-template/0A097DCD-35F9-4DAD-A37E-AC358B71B74D?lockNumber=1"
           id="preview-letter-template-cta"
           role="button"
         >
@@ -308,7 +308,7 @@ exports[`PreviewLetterTemplate component matches snapshot when template status i
           class="nhsuk-button"
           data-testid="preview-letter-template-cta"
           draggable="false"
-          href="/templates/submit-letter-template/0A097DCD-35F9-4DAD-A37E-AC358B71B74D"
+          href="/templates/submit-letter-template/0A097DCD-35F9-4DAD-A37E-AC358B71B74D?lockNumber=1"
           id="preview-letter-template-cta"
           role="button"
         >
@@ -453,7 +453,7 @@ exports[`PreviewLetterTemplate component matches snapshot when template status i
           class="nhsuk-button"
           data-testid="preview-letter-template-cta"
           draggable="false"
-          href="/templates/request-proof-of-template/53525D03-1BC1-4563-ABF9-A74FF04142AF"
+          href="/templates/request-proof-of-template/53525D03-1BC1-4563-ABF9-A74FF04142AF?lockNumber=1"
           id="preview-letter-template-cta"
           role="button"
         >
@@ -985,7 +985,7 @@ exports[`PreviewLetterTemplate component matches snapshot when template status i
           class="nhsuk-button"
           data-testid="preview-letter-template-cta"
           draggable="false"
-          href="/templates/submit-letter-template/2C56C5F6-B3AD-4FF8-A8A2-52E4FA8AF2BE"
+          href="/templates/submit-letter-template/2C56C5F6-B3AD-4FF8-A8A2-52E4FA8AF2BE?lockNumber=1"
           id="preview-letter-template-cta"
           role="button"
         >
@@ -1239,7 +1239,7 @@ exports[`PreviewLetterTemplate component matches snapshot when template status i
           class="nhsuk-button"
           data-testid="preview-letter-template-cta"
           draggable="false"
-          href="/templates/submit-letter-template/2C56C5F6-B3AD-4FF8-A8A2-52E4FA8AF2BE"
+          href="/templates/submit-letter-template/2C56C5F6-B3AD-4FF8-A8A2-52E4FA8AF2BE?lockNumber=1"
           id="preview-letter-template-cta"
           role="button"
         >
diff --git a/frontend/src/__tests__/helpers/routing-config-factory.ts b/frontend/src/__tests__/helpers/routing-config-factory.ts
index 20c537b8e..0260fbb3a 100644
--- a/frontend/src/__tests__/helpers/routing-config-factory.ts
+++ b/frontend/src/__tests__/helpers/routing-config-factory.ts
@@ -20,6 +20,7 @@ export const RoutingConfigFactory = {
       ],
       cascadeGroupOverrides: [{ name: 'standard' }],
       name: 'Test config',
+      lockNumber: 0,
       ...data,
     };
   },
diff --git a/frontend/src/__tests__/utils/get-message-plan-template-ids.test.ts b/frontend/src/__tests__/utils/get-message-plan-template-ids.test.ts
index 1ce2e709d..fdf87a14e 100644
--- a/frontend/src/__tests__/utils/get-message-plan-template-ids.test.ts
+++ b/frontend/src/__tests__/utils/get-message-plan-template-ids.test.ts
@@ -1,22 +1,9 @@
 import { getMessagePlanTemplateIds } from '@utils/get-message-plan-template-ids';
 import type { RoutingConfig } from 'nhs-notify-backend-client';
 
-const baseConfig: RoutingConfig = {
-  id: 'test-id',
-  name: 'Test message plan',
-  status: 'DRAFT',
-  clientId: 'client-1',
-  campaignId: 'campaign-1',
-  createdAt: '2025-01-01T00:00:00.000Z',
-  updatedAt: '2025-01-01T00:00:00.000Z',
-  cascade: [],
-  cascadeGroupOverrides: [{ name: 'standard' }],
-};
-
 describe('getMessagePlanTemplateIds', () => {
   it('should collect unique template IDs from defaults and conditionals', () => {
-    const plan: RoutingConfig = {
-      ...baseConfig,
+    const plan: Pick<RoutingConfig, 'cascade'> = {
       cascade: [
         {
           cascadeGroups: ['standard'],
@@ -48,8 +35,7 @@ describe('getMessagePlanTemplateIds', () => {
   });
 
   it('should return empty set when there are no templates', () => {
-    const plan: RoutingConfig = {
-      ...baseConfig,
+    const plan: Pick<RoutingConfig, 'cascade'> = {
       cascade: [
         {
           cascadeGroups: ['standard'],
diff --git a/frontend/src/__tests__/utils/message-plans.test.ts b/frontend/src/__tests__/utils/message-plans.test.ts
index 380e53e55..adc705d48 100644
--- a/frontend/src/__tests__/utils/message-plans.test.ts
+++ b/frontend/src/__tests__/utils/message-plans.test.ts
@@ -67,6 +67,7 @@ const baseConfig: RoutingConfig = {
   updatedAt: '2025-01-01T00:00:00.000Z',
   cascade: [validCascadeItem],
   cascadeGroupOverrides: [{ name: 'standard' }],
+  lockNumber: 0,
 };
 
 describe('Message plans actions', () => {
@@ -117,6 +118,7 @@ describe('Message plans actions', () => {
           },
         ],
         cascadeGroupOverrides: [{ name: 'standard' }],
+        lockNumber: 0,
       } satisfies Omit<RoutingConfig, 'id' | 'updatedAt'>;
 
       const routingConfigs = [
@@ -196,6 +198,7 @@ describe('Message plans actions', () => {
             cascadeGroupOverrides: [{ name: 'standard' }],
             id: 'a487ed49-e2f7-4871-ac8d-0c6c682c71f5',
             createdAt: '2022-01-01T00:00:00.000Z',
+            lockNumber: 0,
           },
         ],
       });
@@ -350,7 +353,7 @@ describe('Message plans actions', () => {
       });
 
       await expect(
-        updateRoutingConfig(validRoutingConfigId, baseConfig)
+        updateRoutingConfig(validRoutingConfigId, baseConfig, 42)
       ).rejects.toThrow('Failed to get access token');
 
       expect(routingConfigApiMock.update).not.toHaveBeenCalled();
@@ -365,12 +368,17 @@ describe('Message plans actions', () => {
 
       routingConfigApiMock.update.mockResolvedValueOnce({ data: updated });
 
-      const response = await updateRoutingConfig(validRoutingConfigId, updated);
+      const response = await updateRoutingConfig(
+        validRoutingConfigId,
+        updated,
+        42
+      );
 
       expect(routingConfigApiMock.update).toHaveBeenCalledWith(
         'mock-token',
         validRoutingConfigId,
-        updated
+        updated,
+        42
       );
       expect(response).toEqual(updated);
       expect(loggerMock.error).not.toHaveBeenCalled();
@@ -383,7 +391,8 @@ describe('Message plans actions', () => {
 
       const response = await updateRoutingConfig(
         validRoutingConfigId,
-        baseConfig
+        baseConfig,
+        42
       );
 
       expect(response).toBeUndefined();
@@ -398,13 +407,15 @@ describe('Message plans actions', () => {
 
       const response = await updateRoutingConfig(
         validRoutingConfigId,
-        baseConfig
+        baseConfig,
+        42
       );
 
       expect(routingConfigApiMock.update).toHaveBeenCalledWith(
         'mock-token',
         validRoutingConfigId,
-        baseConfig
+        baseConfig,
+        42
       );
       expect(response).toBeUndefined();
       expect(loggerMock.error).toHaveBeenCalledWith(
@@ -422,13 +433,15 @@ describe('Message plans actions', () => {
 
       const response = await updateRoutingConfig(
         invalidRoutingConfigId,
-        baseConfig
+        baseConfig,
+        42
       );
 
       expect(routingConfigApiMock.update).toHaveBeenCalledWith(
         'mock-token',
         invalidRoutingConfigId,
-        baseConfig
+        baseConfig,
+        42
       );
       expect(response).toBeUndefined();
       expect(loggerMock.error).toHaveBeenCalledWith(
@@ -568,6 +581,7 @@ describe('Message plans actions', () => {
           createdAt: now.toISOString(),
           status: 'DRAFT',
           updatedAt: now.toISOString(),
+          lockNumber: 0,
         },
       }));
 
@@ -619,6 +633,7 @@ describe('Message plans actions', () => {
           },
         ],
         cascadeGroupOverrides: [{ name: 'standard' }],
+        lockNumber: 0,
       });
     });
 
diff --git a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
index 469774275..5aa89d8ef 100644
--- a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
+++ b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
@@ -41,6 +41,7 @@ const baseConfig = {
     },
   ],
   cascadeGroupOverrides: [],
+  lockNumber: 0,
 };
 
 describe('removeTemplateFromMessagePlan', () => {
diff --git a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.ts b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.ts
index 8ffe8618f..0510bc48e 100644
--- a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.ts
+++ b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.ts
@@ -2,7 +2,7 @@
 
 import { z } from 'zod';
 import { getRoutingConfig, updateRoutingConfig } from '@utils/message-plans';
-import { $Channel } from 'nhs-notify-backend-client';
+import { $Channel, $LockNumber } from 'nhs-notify-backend-client';
 import { redirect } from 'next/navigation';
 
 export async function removeTemplateFromMessagePlan(formData: FormData) {
@@ -10,17 +10,19 @@ export async function removeTemplateFromMessagePlan(formData: FormData) {
     .object({
       routingConfigId: z.uuidv4(),
       channel: $Channel,
+      lockNumber: $LockNumber,
     })
     .safeParse({
       routingConfigId: formData.get('routingConfigId'),
       channel: formData.get('channel'),
+      lockNumber: formData.get('lockNumber'),
     });
 
   if (!parseResult.success) {
     throw new Error('Invalid form data');
   }
 
-  const { routingConfigId, channel } = parseResult.data;
+  const { routingConfigId, channel, lockNumber } = parseResult.data;
 
   const routingConfig = await getRoutingConfig(routingConfigId);
 
@@ -40,7 +42,7 @@ export async function removeTemplateFromMessagePlan(formData: FormData) {
     cascade: updatedCascade,
   };
 
-  await updateRoutingConfig(routingConfigId, updatedConfig);
+  await updateRoutingConfig(routingConfigId, updatedConfig, lockNumber);
 
   redirect(`/message-plans/choose-templates/${routingConfigId}`);
 }
diff --git a/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/page.tsx b/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/page.tsx
index 2c438685c..1c2785e02 100644
--- a/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/page.tsx
+++ b/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/page.tsx
@@ -53,6 +53,12 @@ export default async function EditMessagePlanSettingsPage({
                 value={routingConfigId}
                 readOnly
               />
+              <input
+                type='hidden'
+                name='lockNumber'
+                value={routingConfig.lockNumber}
+                readOnly
+              />
             </MessagePlanForm>
           </div>
         </div>
diff --git a/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/server-action.ts b/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/server-action.ts
index 5f6ab36ad..3e112687c 100644
--- a/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/server-action.ts
+++ b/frontend/src/app/message-plans/edit-message-plan-settings/[routingConfigId]/server-action.ts
@@ -5,9 +5,11 @@ import { z } from 'zod/v4';
 import type { FormState } from 'nhs-notify-web-template-management-utils';
 import { $MessagePlanFormData } from '@forms/MessagePlan/schema';
 import { updateRoutingConfig } from '@utils/message-plans';
+import { $LockNumber } from 'nhs-notify-backend-client';
 
 const $UpdateMessagePlanFormData = $MessagePlanFormData.extend({
   routingConfigId: z.string({ error: 'Invalid message plan id' }),
+  lockNumber: $LockNumber,
 });
 
 export async function editMessagePlanSettingsServerAction(
@@ -27,10 +29,14 @@ export async function editMessagePlanSettingsServerAction(
 
   delete state.errorState;
 
-  await updateRoutingConfig(parsed.data.routingConfigId, {
-    name: parsed.data.name,
-    campaignId: parsed.data.campaignId,
-  });
+  await updateRoutingConfig(
+    parsed.data.routingConfigId,
+    {
+      name: parsed.data.name,
+      campaignId: parsed.data.campaignId,
+    },
+    parsed.data.lockNumber
+  );
 
   redirect(
     `/message-plans/choose-templates/${parsed.data.routingConfigId}`,
diff --git a/frontend/src/app/request-proof-of-template/[templateId]/page.tsx b/frontend/src/app/request-proof-of-template/[templateId]/page.tsx
index 06df67778..3b25da3d8 100644
--- a/frontend/src/app/request-proof-of-template/[templateId]/page.tsx
+++ b/frontend/src/app/request-proof-of-template/[templateId]/page.tsx
@@ -10,6 +10,7 @@ import {
 import { getTemplate } from '@utils/form-actions';
 import content from '@content/content';
 import { serverIsFeatureEnabled } from '@utils/server-features';
+import { $LockNumber } from 'nhs-notify-backend-client';
 
 const { pageTitle } = content.components.requestProof;
 
@@ -28,6 +29,17 @@ const RequestProofPage = async (props: TemplatePageProps) => {
     return redirect('/invalid-template', RedirectType.replace);
   }
 
+  const searchParams = await props.searchParams;
+
+  const lockNumberResult = $LockNumber.safeParse(searchParams.lockNumber);
+
+  if (!lockNumberResult.success) {
+    return redirect(
+      `/preview-letter-template/${templateId}`,
+      RedirectType.replace
+    );
+  }
+
   const template = await getTemplate(templateId);
 
   const validatedTemplate = validateLetterTemplate(template);
@@ -41,7 +53,7 @@ const RequestProofPage = async (props: TemplatePageProps) => {
       templateName={validatedTemplate.name}
       templateId={validatedTemplate.id}
       channel={validatedTemplate.templateType}
-      lockNumber={validatedTemplate.lockNumber}
+      lockNumber={lockNumberResult.data}
     />
   );
 };
diff --git a/frontend/src/app/submit-letter-template/[templateId]/page.tsx b/frontend/src/app/submit-letter-template/[templateId]/page.tsx
index a396c17ec..253f64d7d 100644
--- a/frontend/src/app/submit-letter-template/[templateId]/page.tsx
+++ b/frontend/src/app/submit-letter-template/[templateId]/page.tsx
@@ -8,6 +8,7 @@ import {
 } from 'nhs-notify-web-template-management-utils';
 import { getTemplate } from '@utils/form-actions';
 import { SubmitLetterTemplate } from '@forms/SubmitTemplate/SubmitLetterTemplate';
+import { $LockNumber } from 'nhs-notify-backend-client';
 
 export async function generateMetadata(): Promise<Metadata> {
   return {
@@ -18,6 +19,17 @@ export async function generateMetadata(): Promise<Metadata> {
 const SubmitLetterTemplatePage = async (props: TemplatePageProps) => {
   const { templateId } = await props.params;
 
+  const searchParams = await props.searchParams;
+
+  const lockNumberResult = $LockNumber.safeParse(searchParams.lockNumber);
+
+  if (!lockNumberResult.success) {
+    return redirect(
+      `/preview-letter-template/${templateId}`,
+      RedirectType.replace
+    );
+  }
+
   const template = await getTemplate(templateId);
 
   const validatedTemplate = validateLetterTemplate(template);
@@ -30,7 +42,7 @@ const SubmitLetterTemplatePage = async (props: TemplatePageProps) => {
     <SubmitLetterTemplate
       templateName={validatedTemplate.name}
       templateId={validatedTemplate.id}
-      lockNumber={validatedTemplate.lockNumber}
+      lockNumber={lockNumberResult.data}
     />
   );
 };
diff --git a/frontend/src/components/molecules/MessagePlanBlock/MessagePlanBlock.tsx b/frontend/src/components/molecules/MessagePlanBlock/MessagePlanBlock.tsx
index 72f989d79..b4ad8cbef 100644
--- a/frontend/src/components/molecules/MessagePlanBlock/MessagePlanBlock.tsx
+++ b/frontend/src/components/molecules/MessagePlanBlock/MessagePlanBlock.tsx
@@ -17,11 +17,13 @@ export function MessagePlanBlock({
   channelItem,
   template,
   routingConfigId,
+  lockNumber,
 }: {
   index: number;
   channelItem: CascadeItem;
   template?: TemplateDto;
   routingConfigId: RoutingConfig['id'];
+  lockNumber: number;
 }) {
   return (
     <li
@@ -40,6 +42,7 @@ export function MessagePlanBlock({
         template={template}
         required={true}
         routingConfigId={routingConfigId}
+        lockNumber={lockNumber}
       />
     </li>
   );
diff --git a/frontend/src/components/molecules/MessagePlanChannelTemplate/MessagePlanChannelTemplate.tsx b/frontend/src/components/molecules/MessagePlanChannelTemplate/MessagePlanChannelTemplate.tsx
index 99e54dc81..4ba25a780 100644
--- a/frontend/src/components/molecules/MessagePlanChannelTemplate/MessagePlanChannelTemplate.tsx
+++ b/frontend/src/components/molecules/MessagePlanChannelTemplate/MessagePlanChannelTemplate.tsx
@@ -17,10 +17,12 @@ export function MessagePlanChannelTemplate({
   channel,
   template,
   routingConfigId,
+  lockNumber,
   required = true,
 }: {
   channel: Channel;
   routingConfigId: RoutingConfig['id'];
+  lockNumber: number;
   template?: TemplateDto;
   required?: boolean;
 }) {
@@ -75,11 +77,23 @@ export function MessagePlanChannelTemplate({
               </li>
               <li>
                 <form>
-                  <input type='hidden' name='channel' value={channel} />
+                  <input
+                    type='hidden'
+                    name='channel'
+                    value={channel}
+                    readOnly
+                  />
                   <input
                     type='hidden'
                     name='routingConfigId'
                     value={routingConfigId}
+                    readOnly
+                  />
+                  <input
+                    type='hidden'
+                    name='lockNumber'
+                    value={lockNumber}
+                    readOnly
                   />
                   <button
                     data-testid={`remove-template-link-${channel}`}
diff --git a/frontend/src/components/organisms/MessagePlanChannelList/MessagePlanChannelList.tsx b/frontend/src/components/organisms/MessagePlanChannelList/MessagePlanChannelList.tsx
index cb06a9e4f..05dcb3dd2 100644
--- a/frontend/src/components/organisms/MessagePlanChannelList/MessagePlanChannelList.tsx
+++ b/frontend/src/components/organisms/MessagePlanChannelList/MessagePlanChannelList.tsx
@@ -36,6 +36,7 @@ export function MessagePlanChannelList({
                 messagePlanChannel.defaultTemplateId
               )}
               routingConfigId={messagePlan.id}
+              lockNumber={messagePlan.lockNumber}
             />
             {/* Show fallback conditions only if there is more than one channel, and not for the last channel */}
             {/* TODO: CCM-11494 Update this logic for letter formats */}
diff --git a/frontend/src/components/organisms/PreviewLetterTemplate/PreviewLetterTemplate.tsx b/frontend/src/components/organisms/PreviewLetterTemplate/PreviewLetterTemplate.tsx
index cbf901767..4fb90dcd4 100644
--- a/frontend/src/components/organisms/PreviewLetterTemplate/PreviewLetterTemplate.tsx
+++ b/frontend/src/components/organisms/PreviewLetterTemplate/PreviewLetterTemplate.tsx
@@ -40,15 +40,15 @@ export function PreviewLetterTemplate({
   const buttonMap: Record<string, ButtonDetails> = {
     NOT_YET_SUBMITTED: {
       text: submitText,
-      href: `${basePath}/submit-letter-template/${template.id}`,
+      href: `${basePath}/submit-letter-template/${template.id}?lockNumber=${template.lockNumber}`,
     },
     PROOF_AVAILABLE: {
       text: routing ? approveProofText : submitText,
-      href: `${basePath}/submit-letter-template/${template.id}`,
+      href: `${basePath}/submit-letter-template/${template.id}?lockNumber=${template.lockNumber}`,
     },
     PENDING_PROOF_REQUEST: {
       text: requestProofText,
-      href: `${basePath}/request-proof-of-template/${template.id}`,
+      href: `${basePath}/request-proof-of-template/${template.id}?lockNumber=${template.lockNumber}`,
     },
   } satisfies Partial<Record<TemplateStatus, ButtonDetails>>;
 
diff --git a/frontend/src/utils/get-message-plan-template-ids.ts b/frontend/src/utils/get-message-plan-template-ids.ts
index a83ce4fa5..972ebc1fa 100644
--- a/frontend/src/utils/get-message-plan-template-ids.ts
+++ b/frontend/src/utils/get-message-plan-template-ids.ts
@@ -4,7 +4,7 @@ import { RoutingConfig } from 'nhs-notify-backend-client';
  * Extracts all template IDs from a RoutingConfig
  */
 export function getMessagePlanTemplateIds(
-  messagePlan: RoutingConfig
+  messagePlan: Pick<RoutingConfig, 'cascade'>
 ): Set<string> {
   const templateIds = new Set<string>();
 
diff --git a/frontend/src/utils/message-plans.ts b/frontend/src/utils/message-plans.ts
index 2c6f31675..bce66d191 100644
--- a/frontend/src/utils/message-plans.ts
+++ b/frontend/src/utils/message-plans.ts
@@ -118,7 +118,8 @@ export async function createRoutingConfig(
 
 export async function updateRoutingConfig(
   routingConfigId: string,
-  updatedRoutingConfig: UpdateRoutingConfig
+  updatedRoutingConfig: UpdateRoutingConfig,
+  lockNumber: number
 ): Promise<RoutingConfig | undefined> {
   const { accessToken } = await getSessionServer();
 
@@ -129,11 +130,12 @@ export async function updateRoutingConfig(
   const { data, error } = await routingConfigurationApiClient.update(
     accessToken,
     routingConfigId,
-    updatedRoutingConfig
+    updatedRoutingConfig,
+    lockNumber
   );
 
   if (error) {
-    logger.error('Failed to get routing configuration', error);
+    logger.error('Failed to update routing configuration', error);
     return;
   }
 
diff --git a/infrastructure/terraform/modules/backend-api/spec.tmpl.json b/infrastructure/terraform/modules/backend-api/spec.tmpl.json
index f61fe4033..a20283acc 100644
--- a/infrastructure/terraform/modules/backend-api/spec.tmpl.json
+++ b/infrastructure/terraform/modules/backend-api/spec.tmpl.json
@@ -647,6 +647,9 @@
             "format": "uuid",
             "type": "string"
           },
+          "lockNumber": {
+            "type": "integer"
+          },
           "name": {
             "type": "string"
           },
@@ -665,6 +668,7 @@
           "clientId",
           "createdAt",
           "id",
+          "lockNumber",
           "name",
           "status",
           "updatedAt"
@@ -1151,6 +1155,15 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "description": "Lock number of the current version of the routing configuration",
+            "in": "header",
+            "name": "X-Lock-Number",
+            "required": true,
+            "schema": {
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -1252,7 +1265,7 @@
           "uri": "arn:aws:apigateway:${AWS_REGION}:lambda:path/2015-03-31/functions/${GET_ROUTING_CONFIG_LAMBDA_ARN}/invocations"
         }
       },
-      "put": {
+      "patch": {
         "description": "Update a routing configuration by Id",
         "parameters": [
           {
@@ -1263,6 +1276,15 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "description": "Lock number of the current version of the routing configuration",
+            "in": "header",
+            "name": "X-Lock-Number",
+            "required": true,
+            "schema": {
+              "type": "integer"
+            }
           }
         ],
         "requestBody": {
@@ -1339,6 +1361,15 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "description": "Lock number of the current version of the routing configuration",
+            "in": "header",
+            "name": "X-Lock-Number",
+            "required": true,
+            "schema": {
+              "type": "integer"
+            }
           }
         ],
         "responses": {
diff --git a/lambdas/backend-api/src/__tests__/api/create-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/create-routing-config.test.ts
index 278f01d7d..467bdbc11 100644
--- a/lambdas/backend-api/src/__tests__/api/create-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/create-routing-config.test.ts
@@ -146,6 +146,7 @@ describe('Create Routing Config Handler', () => {
       createdAt: new Date().toISOString(),
       updatedAt: new Date().toISOString(),
       clientId: 'nhs-notify-client-id',
+      lockNumber: 0,
     };
 
     mocks.routingConfigClient.createRoutingConfig.mockResolvedValueOnce({
diff --git a/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
index f0df14b73..acc5f2769 100644
--- a/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
@@ -26,6 +26,9 @@ describe('Delete Routing Config Handler', () => {
       const event = mock<APIGatewayProxyEvent>({
         requestContext: { authorizer: ctx },
         pathParameters: { templateId: 'id' },
+        headers: {
+          'X-Lock-Number': '0',
+        },
       });
 
       const result = await handler(event, mock<Context>(), jest.fn());
@@ -53,6 +56,9 @@ describe('Delete Routing Config Handler', () => {
       },
       body: JSON.stringify({ name: 'test' }),
       pathParameters: { routingConfigId: undefined },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -87,6 +93,9 @@ describe('Delete Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -104,7 +113,8 @@ describe('Delete Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
     );
   });
 
@@ -120,6 +130,9 @@ describe('Delete Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -134,7 +147,46 @@ describe('Delete Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
+    );
+  });
+
+  test('coerces missing lock number header to empty string', async () => {
+    const { handler, mocks } = setup();
+
+    mocks.routingConfigClient.deleteRoutingConfig.mockResolvedValueOnce({
+      error: {
+        errorMeta: {
+          code: 409,
+          description:
+            'Lock number mismatch - Message Plan has been modified since last read',
+        },
+      },
+    });
+
+    const event = mock<APIGatewayProxyEvent>({
+      requestContext: {
+        authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
+      },
+      pathParameters: { routingConfigId: '1-2-3' },
+    });
+
+    const result = await handler(event, mock<Context>(), jest.fn());
+
+    expect(result).toEqual({
+      statusCode: 409,
+      body: JSON.stringify({
+        statusCode: 409,
+        technicalMessage:
+          'Lock number mismatch - Message Plan has been modified since last read',
+      }),
+    });
+
+    expect(mocks.routingConfigClient.deleteRoutingConfig).toHaveBeenCalledWith(
+      '1-2-3',
+      { userId: 'sub', clientId: 'nhs-notify-client-id' },
+      ''
     );
   });
 });
diff --git a/lambdas/backend-api/src/__tests__/api/delete.test.ts b/lambdas/backend-api/src/__tests__/api/delete.test.ts
index 7f544583a..25b3b030d 100644
--- a/lambdas/backend-api/src/__tests__/api/delete.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/delete.test.ts
@@ -152,7 +152,13 @@ describe('Template API - Delete', () => {
     const { handler, mocks } = setup();
 
     mocks.templateClient.deleteTemplate.mockResolvedValueOnce({
-      error: { errorMeta: { code: 409, description: 'Invalid lock number' } },
+      error: {
+        errorMeta: {
+          code: 409,
+          description:
+            'Lock number mismatch - Template has been modified since last read',
+        },
+      },
     });
 
     const event = mock<APIGatewayProxyEvent>({
@@ -168,7 +174,8 @@ describe('Template API - Delete', () => {
       statusCode: 409,
       body: JSON.stringify({
         statusCode: 409,
-        technicalMessage: 'Invalid lock number',
+        technicalMessage:
+          'Lock number mismatch - Template has been modified since last read',
       }),
     });
 
diff --git a/lambdas/backend-api/src/__tests__/api/proof.test.ts b/lambdas/backend-api/src/__tests__/api/proof.test.ts
index f1d9d2833..5d30bacb5 100644
--- a/lambdas/backend-api/src/__tests__/api/proof.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/proof.test.ts
@@ -112,7 +112,8 @@ describe('Template API - request proof', () => {
       error: {
         errorMeta: {
           code: 409,
-          description: 'Invalid lock number',
+          description:
+            'Lock number mismatch - Template has been modified since last read',
         },
       },
     });
@@ -130,7 +131,8 @@ describe('Template API - request proof', () => {
       statusCode: 409,
       body: JSON.stringify({
         statusCode: 409,
-        technicalMessage: 'Invalid lock number',
+        technicalMessage:
+          'Lock number mismatch - Template has been modified since last read',
       }),
     });
 
diff --git a/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
index e1cafc81e..729a6e139 100644
--- a/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
@@ -28,6 +28,9 @@ describe('Submit Routing Config Handler', () => {
       const event = mock<APIGatewayProxyEvent>({
         requestContext: { authorizer: ctx },
         pathParameters: { templateId: 'id' },
+        headers: {
+          'X-Lock-Number': '0',
+        },
       });
 
       const result = await handler(event, mock<Context>(), jest.fn());
@@ -55,6 +58,9 @@ describe('Submit Routing Config Handler', () => {
       },
       body: JSON.stringify({ name: 'test' }),
       pathParameters: { routingConfigId: undefined },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -89,6 +95,9 @@ describe('Submit Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -106,7 +115,8 @@ describe('Submit Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
     );
   });
 
@@ -124,6 +134,9 @@ describe('Submit Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -138,7 +151,46 @@ describe('Submit Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
+    );
+  });
+
+  test('coerces missing lock number header to empty string', async () => {
+    const { handler, mocks } = setup();
+
+    mocks.routingConfigClient.submitRoutingConfig.mockResolvedValueOnce({
+      error: {
+        errorMeta: {
+          code: 409,
+          description:
+            'Lock number mismatch - Message Plan has been modified since last read',
+        },
+      },
+    });
+
+    const event = mock<APIGatewayProxyEvent>({
+      requestContext: {
+        authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
+      },
+      pathParameters: { routingConfigId: '1-2-3' },
+    });
+
+    const result = await handler(event, mock<Context>(), jest.fn());
+
+    expect(result).toEqual({
+      statusCode: 409,
+      body: JSON.stringify({
+        statusCode: 409,
+        technicalMessage:
+          'Lock number mismatch - Message Plan has been modified since last read',
+      }),
+    });
+
+    expect(mocks.routingConfigClient.submitRoutingConfig).toHaveBeenCalledWith(
+      '1-2-3',
+      { userId: 'sub', clientId: 'nhs-notify-client-id' },
+      ''
     );
   });
 });
diff --git a/lambdas/backend-api/src/__tests__/api/submit.test.ts b/lambdas/backend-api/src/__tests__/api/submit.test.ts
index 3bf6ad637..8dd06fcb3 100644
--- a/lambdas/backend-api/src/__tests__/api/submit.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/submit.test.ts
@@ -118,7 +118,8 @@ describe('Template API - Submit', () => {
       error: {
         errorMeta: {
           code: 409,
-          description: 'Invalid lock number',
+          description:
+            'Lock number mismatch - Template has been modified since last read',
         },
       },
     });
@@ -136,7 +137,8 @@ describe('Template API - Submit', () => {
       statusCode: 409,
       body: JSON.stringify({
         statusCode: 409,
-        technicalMessage: 'Invalid lock number',
+        technicalMessage:
+          'Lock number mismatch - Template has been modified since last read',
       }),
     });
 
diff --git a/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
index fcce4b71c..5dda0bc6b 100644
--- a/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
@@ -31,6 +31,9 @@ describe('Update Routing Config Handler', () => {
       const event = mock<APIGatewayProxyEvent>({
         requestContext: { authorizer: ctx },
         pathParameters: { templateId: 'id' },
+        headers: {
+          'X-Lock-Number': '0',
+        },
       });
 
       const result = await handler(event, mock<Context>(), jest.fn());
@@ -58,6 +61,9 @@ describe('Update Routing Config Handler', () => {
       },
       body: JSON.stringify({ name: 'test' }),
       pathParameters: { routingConfigId: undefined },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -84,6 +90,9 @@ describe('Update Routing Config Handler', () => {
       },
       body: undefined,
       pathParameters: { routingConfigId: 'id' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     mocks.routingConfigClient.updateRoutingConfig.mockResolvedValueOnce({
@@ -111,7 +120,8 @@ describe('Update Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
     );
   });
 
@@ -147,6 +157,9 @@ describe('Update Routing Config Handler', () => {
       },
       body: JSON.stringify(update),
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -165,7 +178,8 @@ describe('Update Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
     );
   });
 
@@ -198,6 +212,9 @@ describe('Update Routing Config Handler', () => {
       },
       body: JSON.stringify(update),
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {
+        'X-Lock-Number': '0',
+      },
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
@@ -213,7 +230,52 @@ describe('Update Routing Config Handler', () => {
       {
         userId: 'sub',
         clientId: 'nhs-notify-client-id',
-      }
+      },
+      '0'
+    );
+  });
+
+  test('coerces missing lock number header to empty string', async () => {
+    const { handler, mocks } = setup();
+
+    mocks.routingConfigClient.updateRoutingConfig.mockResolvedValueOnce({
+      error: {
+        errorMeta: {
+          code: 409,
+          description:
+            'Lock number mismatch - Message Plan has been modified since last read',
+        },
+      },
+    });
+
+    const update: UpdateRoutingConfig = {
+      name: 'new name',
+    };
+
+    const event = mock<APIGatewayProxyEvent>({
+      requestContext: {
+        authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
+      },
+      body: JSON.stringify(update),
+      pathParameters: { routingConfigId: '1-2-3' },
+    });
+
+    const result = await handler(event, mock<Context>(), jest.fn());
+
+    expect(result).toEqual({
+      statusCode: 409,
+      body: JSON.stringify({
+        statusCode: 409,
+        technicalMessage:
+          'Lock number mismatch - Message Plan has been modified since last read',
+      }),
+    });
+
+    expect(mocks.routingConfigClient.updateRoutingConfig).toHaveBeenCalledWith(
+      '1-2-3',
+      update,
+      { userId: 'sub', clientId: 'nhs-notify-client-id' },
+      ''
     );
   });
 });
diff --git a/lambdas/backend-api/src/__tests__/api/update.test.ts b/lambdas/backend-api/src/__tests__/api/update.test.ts
index 2703a66db..7f6d59cde 100644
--- a/lambdas/backend-api/src/__tests__/api/update.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/update.test.ts
@@ -246,7 +246,13 @@ describe('Template API - Update', () => {
     };
 
     mocks.templateClient.updateTemplate.mockResolvedValueOnce({
-      error: { errorMeta: { code: 409, description: 'Invalid lock number' } },
+      error: {
+        errorMeta: {
+          code: 409,
+          description:
+            'Lock number mismatch - Template has been modified since last read',
+        },
+      },
     });
 
     const event = mock<APIGatewayProxyEvent>({
@@ -263,7 +269,8 @@ describe('Template API - Update', () => {
       statusCode: 409,
       body: JSON.stringify({
         statusCode: 409,
-        technicalMessage: 'Invalid lock number',
+        technicalMessage:
+          'Lock number mismatch - Template has been modified since last read',
       }),
     });
 
diff --git a/lambdas/backend-api/src/__tests__/app/routing-config-client.test.ts b/lambdas/backend-api/src/__tests__/app/routing-config-client.test.ts
index 6624255d7..b345793dd 100644
--- a/lambdas/backend-api/src/__tests__/app/routing-config-client.test.ts
+++ b/lambdas/backend-api/src/__tests__/app/routing-config-client.test.ts
@@ -273,6 +273,7 @@ describe('RoutingConfigClient', () => {
         id: 'id',
         status: 'DRAFT',
         updatedAt: date.toISOString(),
+        lockNumber: 0,
       };
 
       mocks.clientConfigRepository.get.mockResolvedValueOnce({
@@ -521,11 +522,12 @@ describe('RoutingConfigClient', () => {
         data: completed,
       });
 
-      const result = await client.submitRoutingConfig(id, user);
+      const result = await client.submitRoutingConfig(id, user, '42');
 
       expect(mocks.routingConfigRepository.submit).toHaveBeenCalledWith(
         id,
-        user
+        user,
+        42
       );
 
       expect(result).toEqual({
@@ -545,7 +547,7 @@ describe('RoutingConfigClient', () => {
         },
       });
 
-      const result = await client.submitRoutingConfig('some-id', user);
+      const result = await client.submitRoutingConfig('some-id', user, '42');
 
       expect(mocks.routingConfigRepository.submit).not.toHaveBeenCalled();
 
@@ -566,7 +568,7 @@ describe('RoutingConfigClient', () => {
         data: { features: { routing: false } },
       });
 
-      const result = await client.submitRoutingConfig('some-id', user);
+      const result = await client.submitRoutingConfig('some-id', user, '42');
 
       expect(mocks.routingConfigRepository.submit).not.toHaveBeenCalled();
 
@@ -579,6 +581,28 @@ describe('RoutingConfigClient', () => {
         },
       });
     });
+
+    test('returns conflict error when lock number is invalid', async () => {
+      const { client, mocks } = setup();
+
+      const result = await client.submitRoutingConfig(
+        'some-id',
+        user,
+        'invalid-lock-number'
+      );
+
+      expect(mocks.routingConfigRepository.submit).not.toHaveBeenCalled();
+
+      expect(result).toEqual({
+        error: {
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 
   describe('deleteRoutingConfig', () => {
@@ -600,11 +624,12 @@ describe('RoutingConfigClient', () => {
         data: deleted,
       });
 
-      const result = await client.deleteRoutingConfig(id, user);
+      const result = await client.deleteRoutingConfig(id, user, '42');
 
       expect(mocks.routingConfigRepository.delete).toHaveBeenCalledWith(
         id,
-        user
+        user,
+        42
       );
 
       expect(result).toEqual({
@@ -627,11 +652,12 @@ describe('RoutingConfigClient', () => {
 
       mocks.routingConfigRepository.delete.mockResolvedValueOnce(errorResponse);
 
-      const result = await client.deleteRoutingConfig(id, user);
+      const result = await client.deleteRoutingConfig(id, user, '42');
 
       expect(mocks.routingConfigRepository.delete).toHaveBeenCalledWith(
         id,
-        user
+        user,
+        42
       );
 
       expect(result).toEqual(errorResponse);
@@ -649,7 +675,7 @@ describe('RoutingConfigClient', () => {
         },
       });
 
-      const result = await client.deleteRoutingConfig('some-id', user);
+      const result = await client.deleteRoutingConfig('some-id', user, '42');
 
       expect(mocks.routingConfigRepository.delete).not.toHaveBeenCalled();
 
@@ -670,7 +696,7 @@ describe('RoutingConfigClient', () => {
         data: { features: { routing: false }, campaignIds: ['campaign'] },
       });
 
-      const result = await client.deleteRoutingConfig('some-id', user);
+      const result = await client.deleteRoutingConfig('some-id', user, '42');
 
       expect(mocks.routingConfigRepository.delete).not.toHaveBeenCalled();
 
@@ -683,6 +709,28 @@ describe('RoutingConfigClient', () => {
         },
       });
     });
+
+    test('returns conflict error when lock number is invalid', async () => {
+      const { client, mocks } = setup();
+
+      const result = await client.deleteRoutingConfig(
+        'some-id',
+        user,
+        'invalid-lock-number'
+      );
+
+      expect(mocks.routingConfigRepository.delete).not.toHaveBeenCalled();
+
+      expect(result).toEqual({
+        error: {
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 
   describe('updateRoutingConfig', () => {
@@ -715,13 +763,15 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).toHaveBeenCalledWith(
         routingConfig.id,
         update,
-        user
+        user,
+        42
       );
 
       expect(result).toEqual({
@@ -748,7 +798,8 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).not.toHaveBeenCalled();
@@ -794,7 +845,8 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).not.toHaveBeenCalled();
@@ -829,7 +881,8 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).not.toHaveBeenCalled();
@@ -864,7 +917,8 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).not.toHaveBeenCalled();
@@ -907,18 +961,51 @@ describe('RoutingConfigClient', () => {
       const result = await client.updateRoutingConfig(
         routingConfig.id,
         update,
-        user
+        user,
+        '42'
       );
 
       expect(mocks.routingConfigRepository.update).toHaveBeenCalledWith(
         routingConfig.id,
         update,
-        user
+        user,
+        42
       );
 
       expect(result).toEqual({
         data: updated,
       });
     });
+
+    test('returns conflict error when lock number is invalid', async () => {
+      const { client, mocks } = setup();
+
+      const update: UpdateRoutingConfig = {
+        campaignId: routingConfig.campaignId,
+        cascade: routingConfig.cascade,
+        cascadeGroupOverrides: routingConfig.cascadeGroupOverrides,
+        name: 'new name',
+      };
+
+      const result = await client.updateRoutingConfig(
+        routingConfig.id,
+        update,
+        user,
+        'invalid-lock-number'
+      );
+
+      expect(mocks.clientConfigRepository.get).not.toHaveBeenCalled();
+      expect(mocks.routingConfigRepository.update).not.toHaveBeenCalled();
+
+      expect(result).toEqual({
+        error: {
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 });
diff --git a/lambdas/backend-api/src/__tests__/app/template-client.test.ts b/lambdas/backend-api/src/__tests__/app/template-client.test.ts
index c6207416c..a5800b658 100644
--- a/lambdas/backend-api/src/__tests__/app/template-client.test.ts
+++ b/lambdas/backend-api/src/__tests__/app/template-client.test.ts
@@ -1318,7 +1318,8 @@ describe('templateClient', () => {
             error: expect.objectContaining({
               errorMeta: {
                 code: 409,
-                description: 'Invalid lock number',
+                description:
+                  'Lock number mismatch - Template has been modified since last read',
               },
             }),
           });
@@ -1678,7 +1679,8 @@ describe('templateClient', () => {
         error: {
           errorMeta: {
             code: 409,
-            description: 'Invalid lock number',
+            description:
+              'Lock number mismatch - Template has been modified since last read',
           },
         },
       });
@@ -1802,7 +1804,8 @@ describe('templateClient', () => {
         error: {
           errorMeta: {
             code: 409,
-            description: 'Invalid lock number',
+            description:
+              'Lock number mismatch - Template has been modified since last read',
           },
         },
       });
@@ -2217,7 +2220,8 @@ describe('templateClient', () => {
             error: expect.objectContaining({
               errorMeta: {
                 code: 409,
-                description: 'Invalid lock number',
+                description:
+                  'Lock number mismatch - Template has been modified since last read',
               },
             }),
           });
diff --git a/lambdas/backend-api/src/__tests__/fixtures/routing-config.ts b/lambdas/backend-api/src/__tests__/fixtures/routing-config.ts
index 60fc2fd10..3f5879697 100644
--- a/lambdas/backend-api/src/__tests__/fixtures/routing-config.ts
+++ b/lambdas/backend-api/src/__tests__/fixtures/routing-config.ts
@@ -18,6 +18,7 @@ export const routingConfig: RoutingConfig = {
   name: 'Test config',
   createdAt: '2025-09-18T15:26:04.338Z',
   updatedAt: '2025-09-18T15:26:04.338Z',
+  lockNumber: 0,
 };
 
 export const makeRoutingConfig = (
diff --git a/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts b/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
index 08fab403e..79c89ab48 100644
--- a/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
+++ b/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
@@ -157,6 +157,7 @@ describe('RoutingConfigRepository', () => {
       id: generatedId,
       status: 'DRAFT',
       updatedAt: date.toISOString(),
+      lockNumber: 0,
     };
 
     const putPayload = {
@@ -239,19 +240,23 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: completed });
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({ data: completed });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
           '#status': 'status',
           '#updatedAt': 'updatedAt',
           '#updatedBy': 'updatedBy',
+          '#lockNumber': 'lockNumber',
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':status': 'COMPLETED',
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -263,7 +268,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #status = :status, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #status = :status, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -274,7 +279,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -298,7 +303,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: completedInvalid });
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -330,7 +335,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -353,7 +358,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -376,7 +381,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.submit(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -388,6 +393,34 @@ describe('RoutingConfigRepository', () => {
         },
       });
     });
+
+    test("returns 409 failure if lock number doesn't match", async () => {
+      const { repo, mocks } = setup();
+
+      const err = new ConditionalCheckFailedException({
+        Item: {
+          status: { S: 'DRAFT' satisfies RoutingConfigStatus },
+          lockNumber: { N: '3' },
+        },
+        $metadata: {},
+        message: 'msg',
+      });
+
+      mocks.dynamo.on(UpdateCommand).rejects(err);
+
+      const result = await repo.submit(routingConfig.id, user, 2);
+
+      expect(result).toEqual({
+        error: {
+          actualError: err,
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 
   describe('delete', () => {
@@ -401,13 +434,15 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: deleted });
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({ data: deleted });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
           '#updatedBy': 'updatedBy',
@@ -415,6 +450,8 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':status': 'DELETED',
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -427,7 +464,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #status = :status, #ttl = :ttl, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #status = :status, #ttl = :ttl, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -438,7 +475,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -462,7 +499,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: completedInvalid });
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -494,7 +531,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -517,7 +554,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -540,7 +577,7 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.delete(routingConfig.id, user);
+      const result = await repo.delete(routingConfig.id, user, 2);
 
       expect(result).toEqual({
         error: {
@@ -552,6 +589,34 @@ describe('RoutingConfigRepository', () => {
         },
       });
     });
+
+    test("returns 409 failure if routing config lock number doesn't match", async () => {
+      const { repo, mocks } = setup();
+
+      const err = new ConditionalCheckFailedException({
+        Item: {
+          status: { S: 'DRAFT' satisfies RoutingConfigStatus },
+          lockNumber: { N: '3' },
+        },
+        $metadata: {},
+        message: 'msg',
+      });
+
+      mocks.dynamo.on(UpdateCommand).rejects(err);
+
+      const result = await repo.delete(routingConfig.id, user, 2);
+
+      expect(result).toEqual({
+        error: {
+          actualError: err,
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 
   describe('update', () => {
@@ -572,16 +637,18 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
           '#campaignId': 'campaignId',
           '#cascade': 'cascade',
           '#cascadeGroupOverrides': 'cascadeGroupOverrides',
+          '#lockNumber': 'lockNumber',
           '#name': 'name',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -592,6 +659,8 @@ describe('RoutingConfigRepository', () => {
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -603,7 +672,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #name = :name, #campaignId = :campaignId, #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #name = :name, #campaignId = :campaignId, #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -621,13 +690,15 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
           '#name': 'name',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -635,6 +706,8 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -646,7 +719,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -664,13 +737,15 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
           '#campaignId': 'campaignId',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -678,6 +753,8 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':campaignId': update.campaignId,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -689,7 +766,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #campaignId = :campaignId, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #campaignId = :campaignId, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -715,21 +792,25 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
           '#cascade': 'cascade',
           '#cascadeGroupOverrides': 'cascadeGroupOverrides',
+          '#lockNumber': 'lockNumber',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
           '#updatedBy': 'updatedBy',
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
           ':updatedAt': date.toISOString(),
@@ -742,7 +823,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -768,13 +849,15 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
           '#name': 'name',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -782,6 +865,8 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -793,7 +878,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -812,13 +897,15 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: updated });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: updated });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
           '#name': 'name',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -826,6 +913,8 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -837,7 +926,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #name = :name, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -854,16 +943,18 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).resolves({ Attributes: routingConfig });
 
-      const result = await repo.update(routingConfig.id, update, user);
+      const result = await repo.update(routingConfig.id, update, user, 2);
 
       expect(result).toEqual({ data: routingConfig });
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
-        ConditionExpression: '#status = :condition_1_status',
+        ConditionExpression:
+          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
         ExpressionAttributeNames: {
           '#campaignId': 'campaignId',
           '#cascade': 'cascade',
           '#cascadeGroupOverrides': 'cascadeGroupOverrides',
+          '#lockNumber': 'lockNumber',
           '#name': 'name',
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -874,6 +965,8 @@ describe('RoutingConfigRepository', () => {
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
           ':condition_1_status': 'DRAFT',
+          ':condition_2_1_lockNumber': 2,
+          ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
           ':updatedBy': user.userId,
@@ -885,7 +978,7 @@ describe('RoutingConfigRepository', () => {
         ReturnValues: 'ALL_NEW',
         TableName: TABLE_NAME,
         UpdateExpression:
-          'SET #name = :name, #campaignId = :campaignId, #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy',
+          'SET #name = :name, #campaignId = :campaignId, #cascade = :cascade, #cascadeGroupOverrides = :cascadeGroupOverrides, #updatedAt = :updatedAt, #updatedBy = :updatedBy ADD #lockNumber :lockNumber',
       });
     });
 
@@ -904,7 +997,8 @@ describe('RoutingConfigRepository', () => {
           name: routingConfig.name,
           campaignId: routingConfig.campaignId,
         },
-        user
+        user,
+        2
       );
 
       expect(result).toEqual({
@@ -936,7 +1030,8 @@ describe('RoutingConfigRepository', () => {
           name: routingConfig.name,
           campaignId: routingConfig.campaignId,
         },
-        user
+        user,
+        2
       );
 
       expect(result).toEqual({
@@ -970,7 +1065,12 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.update(
+        routingConfig.id,
+        { name: 'new-name' },
+        user,
+        2
+      );
 
       expect(result).toEqual({
         error: {
@@ -993,7 +1093,12 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.update(
+        routingConfig.id,
+        { name: 'new-name' },
+        user,
+        2
+      );
 
       expect(result).toEqual({
         error: {
@@ -1016,7 +1121,12 @@ describe('RoutingConfigRepository', () => {
 
       mocks.dynamo.on(UpdateCommand).rejects(err);
 
-      const result = await repo.submit(routingConfig.id, user);
+      const result = await repo.update(
+        routingConfig.id,
+        { name: 'new name' },
+        user,
+        2
+      );
 
       expect(result).toEqual({
         error: {
@@ -1028,5 +1138,38 @@ describe('RoutingConfigRepository', () => {
         },
       });
     });
+
+    test("returns 409 failure if routing config lock number doesn't match", async () => {
+      const { repo, mocks } = setup();
+
+      const err = new ConditionalCheckFailedException({
+        Item: {
+          status: { S: 'DRAFT' satisfies RoutingConfigStatus },
+          lockNumber: { N: '3' },
+        },
+        $metadata: {},
+        message: 'msg',
+      });
+
+      mocks.dynamo.on(UpdateCommand).rejects(err);
+
+      const result = await repo.update(
+        routingConfig.id,
+        { name: 'new-name' },
+        user,
+        2
+      );
+
+      expect(result).toEqual({
+        error: {
+          actualError: err,
+          errorMeta: {
+            code: 409,
+            description:
+              'Lock number mismatch - Message Plan has been modified since last read',
+          },
+        },
+      });
+    });
   });
 });
diff --git a/lambdas/backend-api/src/__tests__/infra/template-repository.test.ts b/lambdas/backend-api/src/__tests__/infra/template-repository.test.ts
index 3bee7e17e..7a099d993 100644
--- a/lambdas/backend-api/src/__tests__/infra/template-repository.test.ts
+++ b/lambdas/backend-api/src/__tests__/infra/template-repository.test.ts
@@ -622,7 +622,8 @@ describe('templateRepository', () => {
           },
           errorCode: 409,
           errorMeta: {
-            description: 'Invalid lock number',
+            description:
+              'Lock number mismatch - Template has been modified since last read',
           },
         },
       ];
@@ -784,7 +785,8 @@ describe('templateRepository', () => {
           lockNumber: 1,
         }),
         code: 409,
-        message: 'Invalid lock number',
+        message:
+          'Lock number mismatch - Template has been modified since last read',
         returnActualError: true,
       },
     ])(
@@ -979,7 +981,10 @@ describe('templateRepository', () => {
             lockNumber: { N: '2' },
           },
           errorCode: 409,
-          errorMeta: { description: 'Invalid lock number' },
+          errorMeta: {
+            description:
+              'Lock number mismatch - Template has been modified since last read',
+          },
         },
       ];
 
@@ -1915,7 +1920,8 @@ describe('templateRepository', () => {
           actualError: err,
           errorMeta: {
             code: 409,
-            description: 'Invalid lock number',
+            description:
+              'Lock number mismatch - Template has been modified since last read',
           },
         },
       });
diff --git a/lambdas/backend-api/src/api/delete-routing-config.ts b/lambdas/backend-api/src/api/delete-routing-config.ts
index f4ab06f28..3df7508e9 100644
--- a/lambdas/backend-api/src/api/delete-routing-config.ts
+++ b/lambdas/backend-api/src/api/delete-routing-config.ts
@@ -22,7 +22,8 @@ export function createHandler({
 
     const { error } = await routingConfigClient.deleteRoutingConfig(
       routingConfigId,
-      user
+      user,
+      event.headers['X-Lock-Number'] ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/submit-routing-config.ts b/lambdas/backend-api/src/api/submit-routing-config.ts
index d530cdb64..b28f9875d 100644
--- a/lambdas/backend-api/src/api/submit-routing-config.ts
+++ b/lambdas/backend-api/src/api/submit-routing-config.ts
@@ -22,7 +22,8 @@ export function createHandler({
 
     const { data, error } = await routingConfigClient.submitRoutingConfig(
       routingConfigId,
-      user
+      user,
+      event.headers['X-Lock-Number'] ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/update-routing-config.ts b/lambdas/backend-api/src/api/update-routing-config.ts
index 501e660b9..1c0c173df 100644
--- a/lambdas/backend-api/src/api/update-routing-config.ts
+++ b/lambdas/backend-api/src/api/update-routing-config.ts
@@ -28,7 +28,8 @@ export function createHandler({
     const { data, error } = await routingConfigClient.updateRoutingConfig(
       routingConfigId,
       payload,
-      { userId, clientId }
+      { userId, clientId },
+      event.headers['X-Lock-Number'] ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/app/routing-config-client.ts b/lambdas/backend-api/src/app/routing-config-client.ts
index 81c2dedfe..2ed233a2a 100644
--- a/lambdas/backend-api/src/app/routing-config-client.ts
+++ b/lambdas/backend-api/src/app/routing-config-client.ts
@@ -2,6 +2,7 @@ import { failure } from '@backend-api/utils/result';
 import {
   $CreateRoutingConfig,
   $ListRoutingConfigFilters,
+  $LockNumber,
   $UpdateRoutingConfig,
   ErrorCase,
   type ListRoutingConfigFilters,
@@ -57,8 +58,18 @@ export class RoutingConfigClient {
   async updateRoutingConfig(
     routingConfigId: string,
     payload: unknown,
-    user: User
+    user: User,
+    lockNumber: number | string
   ): Promise<Result<RoutingConfig>> {
+    const lockNumberValidation = $LockNumber.safeParse(lockNumber);
+
+    if (!lockNumberValidation.success) {
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Message Plan has been modified since last read'
+      );
+    }
+
     const clientConfigurationResult = await this.clientConfigRepository.get(
       user.clientId
     );
@@ -93,14 +104,25 @@ export class RoutingConfigClient {
     return this.routingConfigRepository.update(
       routingConfigId,
       validated,
-      user
+      user,
+      lockNumberValidation.data
     );
   }
 
   async submitRoutingConfig(
     routingConfigId: string,
-    user: User
+    user: User,
+    lockNumber: number | string
   ): Promise<Result<RoutingConfig>> {
+    const lockNumberValidation = $LockNumber.safeParse(lockNumber);
+
+    if (!lockNumberValidation.success) {
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Message Plan has been modified since last read'
+      );
+    }
+
     const clientConfigurationResult = await this.clientConfigRepository.get(
       user.clientId
     );
@@ -114,13 +136,27 @@ export class RoutingConfigClient {
       );
     }
 
-    return this.routingConfigRepository.submit(routingConfigId, user);
+    return this.routingConfigRepository.submit(
+      routingConfigId,
+      user,
+      lockNumberValidation.data
+    );
   }
 
   async deleteRoutingConfig(
     routingConfigId: string,
-    user: User
+    user: User,
+    lockNumber: number | string
   ): Promise<Result<undefined>> {
+    const lockNumberValidation = $LockNumber.safeParse(lockNumber);
+
+    if (!lockNumberValidation.success) {
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Message Plan has been modified since last read'
+      );
+    }
+
     const clientConfigurationResult = await this.clientConfigRepository.get(
       user.clientId
     );
@@ -136,7 +172,8 @@ export class RoutingConfigClient {
 
     const result = await this.routingConfigRepository.delete(
       routingConfigId,
-      user
+      user,
+      lockNumberValidation.data
     );
 
     if (result.error) return result;
diff --git a/lambdas/backend-api/src/app/template-client.ts b/lambdas/backend-api/src/app/template-client.ts
index 5c9388818..ad5ec1d34 100644
--- a/lambdas/backend-api/src/app/template-client.ts
+++ b/lambdas/backend-api/src/app/template-client.ts
@@ -273,7 +273,10 @@ export class TemplateClient {
         z.treeifyError(lockNumberValidation.error)
       );
 
-      return failure(ErrorCase.CONFLICT, 'Invalid lock number');
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Template has been modified since last read'
+      );
     }
 
     const updateResult = await this.templateRepository.update(
@@ -316,7 +319,10 @@ export class TemplateClient {
         z.treeifyError(lockNumberValidation.error)
       );
 
-      return failure(ErrorCase.CONFLICT, 'Invalid lock number');
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Template has been modified since last read'
+      );
     }
 
     const submitResult = await this.templateRepository.submit(
@@ -360,7 +366,10 @@ export class TemplateClient {
         z.treeifyError(lockNumberValidation.error)
       );
 
-      return failure(ErrorCase.CONFLICT, 'Invalid lock number');
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Template has been modified since last read'
+      );
     }
 
     const deleteResult = await this.templateRepository.delete(
@@ -448,7 +457,10 @@ export class TemplateClient {
         z.treeifyError(lockNumberValidation.error)
       );
 
-      return failure(ErrorCase.CONFLICT, 'Invalid lock number');
+      return failure(
+        ErrorCase.CONFLICT,
+        'Lock number mismatch - Template has been modified since last read'
+      );
     }
 
     const clientConfigurationResult = await this.clientConfigRepository.get(
diff --git a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
index 38c4f3f6d..4bd5b7492 100644
--- a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
+++ b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
@@ -23,6 +23,7 @@ import { RoutingConfigQuery } from './query';
 import { RoutingConfigUpdateBuilder } from 'nhs-notify-entity-update-command-builder';
 import { ConditionalCheckFailedException } from '@aws-sdk/client-dynamodb';
 import { calculateTTL } from '@backend-api/utils/calculate-ttl';
+import { unmarshall } from '@aws-sdk/util-dynamodb';
 
 export class RoutingConfigRepository {
   private updateCmdOpts = {
@@ -77,7 +78,8 @@ export class RoutingConfigRepository {
   async update(
     id: string,
     updateData: UpdateRoutingConfig,
-    user: User
+    user: User,
+    lockNumber: number
   ): Promise<ApplicationResult<RoutingConfig>> {
     const { campaignId, cascade, cascadeGroupOverrides, name } = updateData;
 
@@ -101,7 +103,11 @@ export class RoutingConfigRepository {
         .setCascade(cascade)
         .setCascadeGroupOverrides(cascadeGroupOverrides);
     }
-    update.setUpdatedByUserAt(user.userId).expectStatus('DRAFT');
+    update
+      .setUpdatedByUserAt(user.userId)
+      .expectStatus('DRAFT')
+      .expectLockNumber(lockNumber)
+      .incrementLockNumber();
 
     try {
       const result = await this.client.send(new UpdateCommand(update.build()));
@@ -118,13 +124,14 @@ export class RoutingConfigRepository {
 
       return success(parsed.data);
     } catch (error) {
-      return this.handleUpdateError(error);
+      return this.handleUpdateError(error, lockNumber);
     }
   }
 
   async submit(
     id: string,
-    user: User
+    user: User,
+    lockNumber: number
   ): Promise<ApplicationResult<RoutingConfig>> {
     const cmdInput = new RoutingConfigUpdateBuilder(
       this.tableName,
@@ -135,6 +142,8 @@ export class RoutingConfigRepository {
       .setStatus('COMPLETED')
       .expectStatus('DRAFT')
       .setUpdatedByUserAt(user.userId)
+      .expectLockNumber(lockNumber)
+      .incrementLockNumber()
       .build();
 
     try {
@@ -152,13 +161,14 @@ export class RoutingConfigRepository {
 
       return success(parsed.data);
     } catch (error) {
-      return this.handleUpdateError(error);
+      return this.handleUpdateError(error, lockNumber);
     }
   }
 
   async delete(
     id: string,
-    user: User
+    user: User,
+    lockNumber: number
   ): Promise<ApplicationResult<RoutingConfig>> {
     const cmdInput = new RoutingConfigUpdateBuilder(
       this.tableName,
@@ -170,6 +180,8 @@ export class RoutingConfigRepository {
       .setTtl(calculateTTL())
       .expectStatus('DRAFT')
       .setUpdatedByUserAt(user.userId)
+      .expectLockNumber(lockNumber)
+      .incrementLockNumber()
       .build();
 
     try {
@@ -187,7 +199,7 @@ export class RoutingConfigRepository {
 
       return success(parsed.data);
     } catch (error) {
-      return this.handleUpdateError(error);
+      return this.handleUpdateError(error, lockNumber);
     }
   }
 
@@ -230,20 +242,31 @@ export class RoutingConfigRepository {
     );
   }
 
-  private handleUpdateError(err: unknown) {
+  private handleUpdateError(err: unknown, expectedLockNumber: number) {
     if (err instanceof ConditionalCheckFailedException) {
-      const status = err?.Item?.status.S;
+      const item = unmarshall(err.Item ?? {});
 
-      if (!status || status === ('DELETED' satisfies RoutingConfigStatus)) {
+      if (
+        !err.Item ||
+        item.status === ('DELETED' satisfies RoutingConfigStatus)
+      ) {
         return failure(ErrorCase.NOT_FOUND, `Routing configuration not found`);
       }
 
-      if (status === ('COMPLETED' satisfies RoutingConfigStatus)) {
+      if (item.status === ('COMPLETED' satisfies RoutingConfigStatus)) {
         return failure(
           ErrorCase.ALREADY_SUBMITTED,
           `Routing configuration with status COMPLETED cannot be updated`
         );
       }
+
+      if (item.lockNumber !== expectedLockNumber) {
+        return failure(
+          ErrorCase.CONFLICT,
+          'Lock number mismatch - Message Plan has been modified since last read',
+          err
+        );
+      }
     }
 
     return failure(ErrorCase.INTERNAL, 'Failed to update routing config', err);
diff --git a/lambdas/backend-api/src/infra/template-repository.ts b/lambdas/backend-api/src/infra/template-repository.ts
index 2a2ea1f3a..2b0cbb8f4 100644
--- a/lambdas/backend-api/src/infra/template-repository.ts
+++ b/lambdas/backend-api/src/infra/template-repository.ts
@@ -197,7 +197,11 @@ export class TemplateRepository {
         }
 
         if (oldItem.lockNumber !== lockNumber) {
-          return failure(ErrorCase.CONFLICT, 'Invalid lock number', error);
+          return failure(
+            ErrorCase.CONFLICT,
+            'Lock number mismatch - Template has been modified since last read',
+            error
+          );
         }
       }
 
@@ -241,7 +245,11 @@ export class TemplateRepository {
         const oldItem = unmarshall(error.Item);
 
         if (oldItem.lockNumber !== lockNumber) {
-          return failure(ErrorCase.CONFLICT, 'Invalid lock number', error);
+          return failure(
+            ErrorCase.CONFLICT,
+            'Lock number mismatch - Template has been modified since last read',
+            error
+          );
         }
 
         return failure(
@@ -635,7 +643,11 @@ export class TemplateRepository {
         const oldItem = unmarshall(error.Item);
 
         if (oldItem.lockNumber !== lockNumber) {
-          return failure(ErrorCase.CONFLICT, 'Invalid lock number', error);
+          return failure(
+            ErrorCase.CONFLICT,
+            'Lock number mismatch - Template has been modified since last read',
+            error
+          );
         }
 
         return failure(
@@ -757,7 +769,11 @@ export class TemplateRepository {
       }
 
       if (oldItem.lockNumber !== lockNumber) {
-        return failure(ErrorCase.CONFLICT, 'Invalid lock number', error);
+        return failure(
+          ErrorCase.CONFLICT,
+          'Lock number mismatch - Template has been modified since last read',
+          error
+        );
       }
     }
     return failure(ErrorCase.INTERNAL, 'Failed to update template', error);
diff --git a/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts b/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
index 7e55e5861..aa5f6abd9 100644
--- a/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
+++ b/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
@@ -229,6 +229,7 @@ describe('RoutingConfigurationApiClient', () => {
         name: 'name',
         status: 'DRAFT',
         updatedAt: new Date().toISOString(),
+        lockNumber: 0,
       };
 
       axiosMock.onPost('/v1/routing-configuration').reply(201, {
@@ -260,7 +261,7 @@ describe('RoutingConfigurationApiClient', () => {
   describe('update', () => {
     it('should return error when failing to update via API', async () => {
       axiosMock
-        .onPut(`/v1/routing-configuration/${notFoundRoutingConfigId}`)
+        .onPatch(`/v1/routing-configuration/${notFoundRoutingConfigId}`)
         .reply(404, {
           statusCode: 404,
           technicalMessage: 'Not Found',
@@ -289,7 +290,7 @@ describe('RoutingConfigurationApiClient', () => {
         },
       });
       expect(response.data).toBeUndefined();
-      expect(axiosMock.history.put.length).toBe(1);
+      expect(axiosMock.history.patch.length).toBe(1);
     });
 
     it('should return error for invalid routing config ID', async () => {
@@ -316,7 +317,7 @@ describe('RoutingConfigurationApiClient', () => {
         actualError: undefined,
       });
       expect(response.data).toBeUndefined();
-      expect(axiosMock.history.get.length).toBe(0);
+      expect(axiosMock.history.patch.length).toBe(0);
     });
 
     it('should return updated routing configuration on success', async () => {
@@ -329,7 +330,7 @@ describe('RoutingConfigurationApiClient', () => {
       };
 
       axiosMock
-        .onPut(`/v1/routing-configuration/${validRoutingConfigId}`)
+        .onPatch(`/v1/routing-configuration/${validRoutingConfigId}`)
         .reply(200, {
           data: body,
         });
@@ -342,7 +343,7 @@ describe('RoutingConfigurationApiClient', () => {
 
       expect(response.error).toBeUndefined();
       expect(response.data).toEqual(body);
-      expect(axiosMock.history.put.length).toBe(1);
+      expect(axiosMock.history.patch.length).toBe(1);
     });
   });
 });
diff --git a/lambdas/backend-client/src/routing-config-api-client.ts b/lambdas/backend-client/src/routing-config-api-client.ts
index 922a4043b..61453dd6c 100644
--- a/lambdas/backend-client/src/routing-config-api-client.ts
+++ b/lambdas/backend-client/src/routing-config-api-client.ts
@@ -9,7 +9,7 @@ import type {
   RoutingConfigStatusActive,
   RoutingConfigSuccessList,
   PostV1RoutingConfigurationData,
-  PutV1RoutingConfigurationByRoutingConfigIdData,
+  PatchV1RoutingConfigurationByRoutingConfigIdData,
   UpdateRoutingConfig,
 } from './types/generated';
 import { ErrorCase } from './types/error-cases';
@@ -125,7 +125,8 @@ export const routingConfigurationApiClient = {
   async update(
     token: string,
     id: RoutingConfig['id'],
-    routingConfig: UpdateRoutingConfig
+    routingConfig: UpdateRoutingConfig,
+    lockNumber: number
   ): Promise<Result<RoutingConfig>> {
     if (!uuidSchema.safeParse(id).success) {
       return {
@@ -140,12 +141,12 @@ export const routingConfigurationApiClient = {
       };
     }
     const url = `/v1/routing-configuration/${id}` satisfies OpenApiToTemplate<
-      PutV1RoutingConfigurationByRoutingConfigIdData['url']
+      PatchV1RoutingConfigurationByRoutingConfigIdData['url']
     >;
 
     const { data, error } = await catchAxiosError(
-      httpClient.put<RoutingConfigSuccess>(url, routingConfig, {
-        headers: { Authorization: token },
+      httpClient.patch<RoutingConfigSuccess>(url, routingConfig, {
+        headers: { Authorization: token, 'X-Lock-Number': String(lockNumber) },
       })
     );
 
diff --git a/lambdas/backend-client/src/schemas/routing-config.ts b/lambdas/backend-client/src/schemas/routing-config.ts
index 70cc8f144..9b5a2472a 100644
--- a/lambdas/backend-client/src/schemas/routing-config.ts
+++ b/lambdas/backend-client/src/schemas/routing-config.ts
@@ -18,7 +18,7 @@ import type {
   UpdateRoutingConfig,
 } from '../types/generated';
 import { schemaFor } from './schema-for';
-import { $Language, $LetterType } from './template-schema';
+import { $Language, $LetterType, $LockNumber } from './template-schema';
 import {
   CASCADE_GROUP_NAME_LIST,
   CHANNEL_LIST,
@@ -155,7 +155,10 @@ const $RoutingConfigStatusActive = schemaFor<RoutingConfigStatusActive>()(
   $RoutingConfigStatus.exclude(['DELETED'])
 );
 
-export const $RoutingConfig = schemaFor<RoutingConfig>()(
+export const $RoutingConfig = schemaFor<
+  RoutingConfig,
+  Omit<RoutingConfig, 'lockNumber'>
+>()(
   z.object({
     campaignId: z.string(),
     cascade: z.array($CascadeItem).nonempty(),
@@ -166,6 +169,7 @@ export const $RoutingConfig = schemaFor<RoutingConfig>()(
     status: $RoutingConfigStatus,
     createdAt: z.string(),
     updatedAt: z.string(),
+    lockNumber: $LockNumber.default(0),
   })
 );
 
diff --git a/lambdas/backend-client/src/schemas/template-schema.ts b/lambdas/backend-client/src/schemas/template-schema.ts
index 89fbbdffe..6a62eaf04 100644
--- a/lambdas/backend-client/src/schemas/template-schema.ts
+++ b/lambdas/backend-client/src/schemas/template-schema.ts
@@ -142,9 +142,9 @@ export const $CreateUpdateTemplate = schemaFor<
 export const $LockNumber = z.coerce
   .string()
   .trim()
-  .min(1)
+  .min(1) // min string length is 1
   .transform(Number)
-  .pipe(z.number().int().min(0));
+  .pipe(z.number().int().min(0)); // min integer value is 0
 
 const $TemplateDtoFields = z
   .object({
diff --git a/lambdas/backend-client/src/types/generated/types.gen.ts b/lambdas/backend-client/src/types/generated/types.gen.ts
index cdc91463c..cb5fc11f9 100644
--- a/lambdas/backend-client/src/types/generated/types.gen.ts
+++ b/lambdas/backend-client/src/types/generated/types.gen.ts
@@ -196,6 +196,7 @@ export type RoutingConfig = {
   clientId: string;
   createdAt: string;
   id: string;
+  lockNumber: number;
   name: string;
   status: RoutingConfigStatus;
   updatedAt: string;
@@ -361,6 +362,12 @@ export type PostV1RoutingConfigurationResponse =
 
 export type DeleteV1RoutingConfigurationByRoutingConfigIdData = {
   body?: never;
+  headers: {
+    /**
+     * Lock number of the current version of the routing configuration
+     */
+    'X-Lock-Number': number;
+  };
   path: {
     /**
      * ID of routing configuration to delete
@@ -423,11 +430,17 @@ export type GetV1RoutingConfigurationByRoutingConfigIdResponses = {
 export type GetV1RoutingConfigurationByRoutingConfigIdResponse =
   GetV1RoutingConfigurationByRoutingConfigIdResponses[keyof GetV1RoutingConfigurationByRoutingConfigIdResponses];
 
-export type PutV1RoutingConfigurationByRoutingConfigIdData = {
+export type PatchV1RoutingConfigurationByRoutingConfigIdData = {
   /**
    * Routing configuration update to apply
    */
   body: UpdateRoutingConfig;
+  headers: {
+    /**
+     * Lock number of the current version of the routing configuration
+     */
+    'X-Lock-Number': number;
+  };
   path: {
     /**
      * ID of routing configuration to update
@@ -438,28 +451,34 @@ export type PutV1RoutingConfigurationByRoutingConfigIdData = {
   url: '/v1/routing-configuration/{routingConfigId}';
 };
 
-export type PutV1RoutingConfigurationByRoutingConfigIdErrors = {
+export type PatchV1RoutingConfigurationByRoutingConfigIdErrors = {
   /**
    * Error
    */
   default: Failure;
 };
 
-export type PutV1RoutingConfigurationByRoutingConfigIdError =
-  PutV1RoutingConfigurationByRoutingConfigIdErrors[keyof PutV1RoutingConfigurationByRoutingConfigIdErrors];
+export type PatchV1RoutingConfigurationByRoutingConfigIdError =
+  PatchV1RoutingConfigurationByRoutingConfigIdErrors[keyof PatchV1RoutingConfigurationByRoutingConfigIdErrors];
 
-export type PutV1RoutingConfigurationByRoutingConfigIdResponses = {
+export type PatchV1RoutingConfigurationByRoutingConfigIdResponses = {
   /**
    * 200 response
    */
   200: RoutingConfigSuccess;
 };
 
-export type PutV1RoutingConfigurationByRoutingConfigIdResponse =
-  PutV1RoutingConfigurationByRoutingConfigIdResponses[keyof PutV1RoutingConfigurationByRoutingConfigIdResponses];
+export type PatchV1RoutingConfigurationByRoutingConfigIdResponse =
+  PatchV1RoutingConfigurationByRoutingConfigIdResponses[keyof PatchV1RoutingConfigurationByRoutingConfigIdResponses];
 
 export type PatchV1RoutingConfigurationByRoutingConfigIdSubmitData = {
   body?: never;
+  headers: {
+    /**
+     * Lock number of the current version of the routing configuration
+     */
+    'X-Lock-Number': number;
+  };
   path: {
     /**
      * ID of routing configuration to finalise
diff --git a/tests/test-team/helpers/factories/routing-config-factory.ts b/tests/test-team/helpers/factories/routing-config-factory.ts
index 6141d3045..c95b2740f 100644
--- a/tests/test-team/helpers/factories/routing-config-factory.ts
+++ b/tests/test-team/helpers/factories/routing-config-factory.ts
@@ -41,6 +41,7 @@ export const RoutingConfigFactory = {
       status: 'DRAFT',
       createdAt: new Date().toISOString(),
       updatedAt: new Date().toISOString(),
+      lockNumber: 0,
       ...routingConfig,
       ...apiPayload,
     };
diff --git a/tests/test-team/template-mgmt-api-tests/create-routing-configuration.api.spec.ts b/tests/test-team/template-mgmt-api-tests/create-routing-configuration.api.spec.ts
index d39f1f93b..676c52dd2 100644
--- a/tests/test-team/template-mgmt-api-tests/create-routing-configuration.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/create-routing-configuration.api.spec.ts
@@ -64,6 +64,7 @@ test.describe('POST /v1/routing-configuration', () => {
         id: expect.stringMatching(uuidRegExp),
         status: 'DRAFT',
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: 0,
       },
     });
 
@@ -135,6 +136,7 @@ test.describe('POST /v1/routing-configuration', () => {
         id: expect.stringMatching(uuidRegExp),
         status: 'DRAFT',
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: 0,
       },
     });
 
diff --git a/tests/test-team/template-mgmt-api-tests/delete-routing-config.api.spec.ts b/tests/test-team/template-mgmt-api-tests/delete-routing-config.api.spec.ts
index 4942ccf6f..3e11060f1 100644
--- a/tests/test-team/template-mgmt-api-tests/delete-routing-config.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/delete-routing-config.api.spec.ts
@@ -5,7 +5,6 @@ import {
   testUsers,
 } from '../helpers/auth/cognito-auth-helper';
 import { RoutingConfigStorageHelper } from '../helpers/db/routing-config-storage-helper';
-import type { FactoryRoutingConfig } from '../helpers/types';
 import { RoutingConfigFactory } from '../helpers/factories/routing-config-factory';
 
 test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
@@ -16,12 +15,6 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   let userSharedClient: TestUser;
   let userRoutingDisabled: TestUser;
 
-  let routingConfigNoUpdates: FactoryRoutingConfig;
-  let routingConfigSuccessfullyDelete: FactoryRoutingConfig;
-  let routingConfigSubmitted: FactoryRoutingConfig;
-  let routingConfigAlreadyDeleted: FactoryRoutingConfig;
-  let routingConfigDeleteBySharedClientUser: FactoryRoutingConfig;
-
   test.beforeAll(async () => {
     user1 = await authHelper.getTestUser(testUsers.User1.userId);
     userDifferentClient = await authHelper.getTestUser(
@@ -29,27 +22,6 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
     );
     userSharedClient = await authHelper.getTestUser(testUsers.User7.userId);
     userRoutingDisabled = await authHelper.getTestUser(testUsers.User2.userId);
-
-    routingConfigNoUpdates = RoutingConfigFactory.create(user1);
-    routingConfigSuccessfullyDelete = RoutingConfigFactory.create(user1);
-
-    routingConfigSubmitted = RoutingConfigFactory.create(user1, {
-      status: 'COMPLETED',
-    });
-
-    routingConfigAlreadyDeleted = RoutingConfigFactory.create(user1, {
-      status: 'DELETED',
-    });
-
-    routingConfigDeleteBySharedClientUser = RoutingConfigFactory.create(user1);
-
-    await storageHelper.seed([
-      routingConfigNoUpdates.dbEntry,
-      routingConfigSuccessfullyDelete.dbEntry,
-      routingConfigSubmitted.dbEntry,
-      routingConfigAlreadyDeleted.dbEntry,
-      routingConfigDeleteBySharedClientUser.dbEntry,
-    ]);
   });
 
   test.afterAll(async () => {
@@ -57,8 +29,13 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   });
 
   test('returns 401 if no auth token', async ({ request }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config`
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
+      { headers: { 'X-Lock-Number': String(dbEntry.lockNumber) } }
     );
     expect(response.status()).toBe(401);
     expect(await response.json()).toEqual({
@@ -68,10 +45,11 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
 
   test('returns 404 if routing config does not exist', async ({ request }) => {
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/noexist`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/no-exist`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': '0',
         },
       }
     );
@@ -85,11 +63,16 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   test('returns 404 if routing config exists but is owned by a different client', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigNoUpdates.dbEntry.id}`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userDifferentClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -102,11 +85,16 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   });
 
   test('returns 204 no content on successful deletion', async ({ request }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSuccessfullyDelete.dbEntry.id}`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -117,11 +105,18 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   test('returns 400 - cannot delete a COMPLETED routing config', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'COMPLETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSubmitted.dbEntry.id}`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -140,11 +135,18 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   test('returns 404 - cannot delete an already DELETED routing config', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'DELETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigAlreadyDeleted.dbEntry.id}`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -162,13 +164,18 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   test('user belonging to the same client as the creator can delete', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     expect(user1.clientId).toBe(userSharedClient.clientId);
 
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigDeleteBySharedClientUser.dbEntry.id}`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userSharedClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -179,11 +186,16 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
   test('returns 400 if routing feature is disabled on the client', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(userRoutingDisabled);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.delete(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userRoutingDisabled.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -195,4 +207,54 @@ test.describe('DELETE /v1/routing-configuration/:routingConfigId', () => {
       technicalMessage: 'Routing feature is disabled',
     });
   });
+
+  test('returns 409 if the lock number header is not set', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.delete(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
+  test('returns 409 if the lock number header does not match the current one', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.delete(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber + 1),
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/delete-template.api.spec.ts b/tests/test-team/template-mgmt-api-tests/delete-template.api.spec.ts
index db301025c..1a509711e 100644
--- a/tests/test-team/template-mgmt-api-tests/delete-template.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/delete-template.api.spec.ts
@@ -858,7 +858,8 @@ test.describe('DELETE /v1/template/:templateId', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 
@@ -900,7 +901,8 @@ test.describe('DELETE /v1/template/:templateId', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/request-proof.api.spec.ts b/tests/test-team/template-mgmt-api-tests/request-proof.api.spec.ts
index f4ef97814..d19825c45 100644
--- a/tests/test-team/template-mgmt-api-tests/request-proof.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/request-proof.api.spec.ts
@@ -332,7 +332,8 @@ test.describe('POST /v1/template/:templateId/proof', () => {
 
     expect(result).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 
@@ -381,7 +382,8 @@ test.describe('POST /v1/template/:templateId/proof', () => {
 
     expect(result).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/submit-routing-config.api.spec.ts b/tests/test-team/template-mgmt-api-tests/submit-routing-config.api.spec.ts
index c17cb18c9..38b71cfad 100644
--- a/tests/test-team/template-mgmt-api-tests/submit-routing-config.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/submit-routing-config.api.spec.ts
@@ -6,7 +6,6 @@ import {
 } from '../helpers/auth/cognito-auth-helper';
 import { isoDateRegExp } from 'nhs-notify-web-template-management-test-helper-utils';
 import { RoutingConfigStorageHelper } from '../helpers/db/routing-config-storage-helper';
-import type { FactoryRoutingConfig } from '../helpers/types';
 import { RoutingConfigFactory } from '../helpers/factories/routing-config-factory';
 import { RoutingConfigStatus } from 'nhs-notify-backend-client';
 
@@ -18,12 +17,6 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   let userSharedClient: TestUser;
   let userRoutingDisabled: TestUser;
 
-  let routingConfigNoUpdates: FactoryRoutingConfig;
-  let routingConfigSuccessfullySubmit: FactoryRoutingConfig;
-  let routingConfigAlreadySubmitted: FactoryRoutingConfig;
-  let routingConfigDeleted: FactoryRoutingConfig;
-  let routingConfigSubmitBySharedClientUser: FactoryRoutingConfig;
-
   test.beforeAll(async () => {
     user1 = await authHelper.getTestUser(testUsers.User1.userId);
     userDifferentClient = await authHelper.getTestUser(
@@ -31,27 +24,6 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
     );
     userSharedClient = await authHelper.getTestUser(testUsers.User7.userId);
     userRoutingDisabled = await authHelper.getTestUser(testUsers.User2.userId);
-
-    routingConfigNoUpdates = RoutingConfigFactory.create(user1);
-    routingConfigSuccessfullySubmit = RoutingConfigFactory.create(user1);
-
-    routingConfigAlreadySubmitted = RoutingConfigFactory.create(user1, {
-      status: 'COMPLETED',
-    });
-
-    routingConfigDeleted = RoutingConfigFactory.create(user1, {
-      status: 'DELETED',
-    });
-
-    routingConfigSubmitBySharedClientUser = RoutingConfigFactory.create(user1);
-
-    await storageHelper.seed([
-      routingConfigNoUpdates.dbEntry,
-      routingConfigSuccessfullySubmit.dbEntry,
-      routingConfigAlreadySubmitted.dbEntry,
-      routingConfigDeleted.dbEntry,
-      routingConfigSubmitBySharedClientUser.dbEntry,
-    ]);
   });
 
   test.afterAll(async () => {
@@ -59,9 +31,19 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   });
 
   test('returns 401 if no auth token', async ({ request }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config/submit`
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
+      {
+        headers: {
+          'X-Lock-Number': String(dbEntry.lockNumber),
+        },
+      }
     );
+
     expect(response.status()).toBe(401);
     expect(await response.json()).toEqual({
       message: 'Unauthorized',
@@ -70,10 +52,11 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
 
   test('returns 404 if routing config does not exist', async ({ request }) => {
     const response = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/noexist/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/no-exist/submit`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': '0',
         },
       }
     );
@@ -90,11 +73,16 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   test('returns 404 if routing config exists but is owned by a different client', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const updateResponse = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigNoUpdates.dbEntry.id}/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await userDifferentClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -109,13 +97,18 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   test('returns 200 and the updated routing config data', async ({
     request,
   }) => {
+    const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const start = new Date();
 
     const updateResponse = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSuccessfullySubmit.dbEntry.id}/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -127,26 +120,32 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
     expect(updated).toEqual({
       statusCode: 200,
       data: {
-        ...routingConfigSuccessfullySubmit.apiResponse,
+        ...apiResponse,
         status: 'COMPLETED' satisfies RoutingConfigStatus,
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: dbEntry.lockNumber + 1,
       },
     });
 
     expect(updated.data.updatedAt).toBeDateRoughlyBetween([start, new Date()]);
-    expect(updated.data.createdAt).toEqual(
-      routingConfigSuccessfullySubmit.dbEntry.createdAt
-    );
+    expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
   });
 
   test('returns 400 - cannot submit a COMPLETED routing config', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'COMPLETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
     const failedSubmitResponse = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigAlreadySubmitted.dbEntry.id}/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -165,11 +164,18 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   test('returns 404 - cannot submit a DELETED routing config', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'DELETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
     const failedSubmitResponse = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigDeleted.dbEntry.id}/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -187,11 +193,16 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   test('user belonging to the same client as the creator can submit', async ({
     request,
   }) => {
+    const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const updateResponse = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSubmitBySharedClientUser.dbEntry.id}/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await userSharedClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -205,9 +216,10 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
     expect(updated).toEqual({
       statusCode: 200,
       data: {
-        ...routingConfigSubmitBySharedClientUser.apiResponse,
+        ...apiResponse,
         status: 'COMPLETED' satisfies RoutingConfigStatus,
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: dbEntry.lockNumber + 1,
       },
     });
   });
@@ -215,11 +227,16 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
   test('returns 400 if routing feature is disabled on the client', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const response = await request.patch(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config/submit`,
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
       {
         headers: {
           Authorization: await userRoutingDisabled.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
       }
     );
@@ -231,4 +248,55 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId/submit', () => {
       technicalMessage: 'Routing feature is disabled',
     });
   });
+
+  test('returns 409 if the lock number header is not set', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
+
+  test('returns 409 if the lock number header does not match the current one', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}/submit`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber + 1),
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/submit-template.api.spec.ts b/tests/test-team/template-mgmt-api-tests/submit-template.api.spec.ts
index 1a9bca349..91982524c 100644
--- a/tests/test-team/template-mgmt-api-tests/submit-template.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/submit-template.api.spec.ts
@@ -1098,7 +1098,8 @@ test.describe('POST /v1/template/:templateId/submit', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 
@@ -1140,7 +1141,8 @@ test.describe('POST /v1/template/:templateId/submit', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
index b1e3eb91a..20bfe4a4f 100644
--- a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
@@ -6,10 +6,9 @@ import {
 } from '../helpers/auth/cognito-auth-helper';
 import { isoDateRegExp } from 'nhs-notify-web-template-management-test-helper-utils';
 import { RoutingConfigStorageHelper } from '../helpers/db/routing-config-storage-helper';
-import type { FactoryRoutingConfig } from '../helpers/types';
 import { RoutingConfigFactory } from '../helpers/factories/routing-config-factory';
 
-test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
+test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
   const authHelper = createAuthHelper();
   const storageHelper = new RoutingConfigStorageHelper();
   let user1: TestUser;
@@ -18,12 +17,6 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   let userRoutingDisabled: TestUser;
   let userMultiCampaign: TestUser;
 
-  let routingConfigNoUpdates: FactoryRoutingConfig;
-  let routingConfigSuccessfullyUpdate: FactoryRoutingConfig;
-  let routingConfigCompleted: FactoryRoutingConfig;
-  let routingConfigDeleted: FactoryRoutingConfig;
-  let routingConfigSubmitBySharedClientUser: FactoryRoutingConfig;
-
   test.beforeAll(async () => {
     user1 = await authHelper.getTestUser(testUsers.User1.userId);
     userDifferentClient = await authHelper.getTestUser(
@@ -34,27 +27,6 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     userMultiCampaign = await authHelper.getTestUser(
       testUsers.UserWithMultipleCampaigns.userId
     );
-
-    routingConfigNoUpdates = RoutingConfigFactory.create(user1);
-    routingConfigSuccessfullyUpdate = RoutingConfigFactory.create(user1);
-
-    routingConfigCompleted = RoutingConfigFactory.create(user1, {
-      status: 'COMPLETED',
-    });
-
-    routingConfigDeleted = RoutingConfigFactory.create(user1, {
-      status: 'DELETED',
-    });
-
-    routingConfigSubmitBySharedClientUser = RoutingConfigFactory.create(user1);
-
-    await storageHelper.seed([
-      routingConfigNoUpdates.dbEntry,
-      routingConfigSuccessfullyUpdate.dbEntry,
-      routingConfigCompleted.dbEntry,
-      routingConfigDeleted.dbEntry,
-      routingConfigSubmitBySharedClientUser.dbEntry,
-    ]);
   });
 
   test.afterAll(async () => {
@@ -63,8 +35,9 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   });
 
   test('returns 401 if no auth token', async ({ request }) => {
-    const response = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config`
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config`,
+      { headers: { 'X-Lock-Number': '0' } }
     );
     expect(response.status()).toBe(401);
     expect(await response.json()).toEqual({
@@ -73,13 +46,16 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   });
 
   test('returns 404 if routing config does not exist', async ({ request }) => {
-    const response = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/noexist`,
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/no-exist`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': '0',
+        },
+        data: {
+          name: 'foo',
         },
-        data: routingConfigNoUpdates.apiPayload,
       }
     );
     expect(response.status()).toBe(404);
@@ -92,16 +68,20 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('returns 404 if routing config exists but is owned by a different client', async ({
     request,
   }) => {
-    const { apiPayload, dbEntry } =
-      RoutingConfigFactory.create(userDifferentClient);
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
 
-    const updateResponse = await request.put(
+    const updateResponse = await request.patch(
       `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userDifferentClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
+        },
+        data: {
+          name: 'new-name',
         },
-        data: apiPayload,
       }
     );
 
@@ -115,18 +95,22 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('returns 200 and the updated routing config data', async ({
     request,
   }) => {
+    const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const start = new Date();
 
     const update = {
-      ...routingConfigSuccessfullyUpdate.apiPayload,
       name: 'new name',
     };
 
-    const updateResponse = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSuccessfullyUpdate.dbEntry.id}`,
+    const updateResponse = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
         data: update,
       }
@@ -139,29 +123,34 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     expect(updated).toEqual({
       statusCode: 200,
       data: {
-        ...routingConfigSuccessfullyUpdate.apiResponse,
+        ...apiResponse,
         ...update,
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: dbEntry.lockNumber + 1,
       },
     });
 
     expect(updated.data.updatedAt).toBeDateRoughlyBetween([start, new Date()]);
-    expect(updated.data.createdAt).toEqual(
-      routingConfigSuccessfullyUpdate.dbEntry.createdAt
-    );
+    expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
   });
 
   test('returns 400 - cannot update a COMPLETED routing config', async ({
     request,
   }) => {
-    const response = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigCompleted.dbEntry.id}`,
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'COMPLETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
         data: {
-          ...routingConfigCompleted.apiPayload,
           name: 'new name',
         },
       }
@@ -179,17 +168,22 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('returns 400 if campaignId is not available for the client', async ({
     request,
   }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const campaignId = 'not_a_client_campaign';
 
-    const response = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigNoUpdates.dbEntry.id}`,
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
-        data: RoutingConfigFactory.create(user1, {
+        data: {
           campaignId,
-        }).apiPayload,
+        },
       }
     );
 
@@ -209,14 +203,20 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('returns 404 - cannot update a DELETED routing config', async ({
     request,
   }) => {
-    const failedSubmitResponse = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigDeleted.dbEntry.id}`,
+    const { dbEntry } = RoutingConfigFactory.create(user1, {
+      status: 'DELETED',
+    });
+
+    await storageHelper.seed([dbEntry]);
+
+    const failedSubmitResponse = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
         data: {
-          ...routingConfigDeleted.apiPayload,
           name: 'new name',
         },
       }
@@ -235,16 +235,20 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('user belonging to the same client as the creator can update', async ({
     request,
   }) => {
+    const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
     const update = {
-      ...routingConfigSuccessfullyUpdate.apiPayload,
       name: 'new name',
     };
 
-    const updateResponse = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfigSubmitBySharedClientUser.dbEntry.id}`,
+    const updateResponse = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userSharedClient.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
         data: update,
       }
@@ -259,9 +263,10 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     expect(updated).toEqual({
       statusCode: 200,
       data: {
-        ...routingConfigSubmitBySharedClientUser.apiResponse,
+        ...apiResponse,
         ...update,
         updatedAt: expect.stringMatching(isoDateRegExp),
+        lockNumber: dbEntry.lockNumber + 1,
       },
     });
   });
@@ -269,13 +274,19 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
   test('returns 400 if routing feature is disabled on the client', async ({
     request,
   }) => {
-    const response = await request.put(
-      `${process.env.API_BASE_URL}/v1/routing-configuration/some-routing-config`,
+    const { dbEntry, apiPayload } =
+      RoutingConfigFactory.create(userRoutingDisabled);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
       {
         headers: {
           Authorization: await userRoutingDisabled.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber),
         },
-        data: RoutingConfigFactory.create(userRoutingDisabled).apiPayload,
+        data: apiPayload,
       }
     );
 
@@ -291,9 +302,9 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     test('name only - returns 200 and the updated routing config data', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(user1);
+      const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         name: 'new name',
@@ -301,11 +312,12 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
 
       const start = new Date();
 
-      const updateResponse = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const updateResponse = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -318,9 +330,10 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
       expect(updated).toEqual({
         statusCode: 200,
         data: {
-          ...routingConfig.apiResponse,
+          ...apiResponse,
           ...update,
           updatedAt: expect.stringMatching(isoDateRegExp),
+          lockNumber: dbEntry.lockNumber + 1,
         },
       });
 
@@ -328,26 +341,28 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
         start,
         new Date(),
       ]);
-      expect(updated.data.createdAt).toEqual(routingConfig.dbEntry.createdAt);
+      expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
     });
 
     test('campaignId only - returns 200 and the updated routing config data', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(userMultiCampaign);
+      const { dbEntry, apiResponse } =
+        RoutingConfigFactory.create(userMultiCampaign);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         campaignId: userMultiCampaign.campaignIds?.[1],
       };
       const start = new Date();
 
-      const updateResponse = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const updateResponse = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await userMultiCampaign.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -360,9 +375,10 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
       expect(updated).toEqual({
         statusCode: 200,
         data: {
-          ...routingConfig.apiResponse,
+          ...apiResponse,
           ...update,
           updatedAt: expect.stringMatching(isoDateRegExp),
+          lockNumber: dbEntry.lockNumber + 1,
         },
       });
 
@@ -370,15 +386,15 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
         start,
         new Date(),
       ]);
-      expect(updated.data.createdAt).toEqual(routingConfig.dbEntry.createdAt);
+      expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
     });
 
     test('cascade and cascadeGroupOverrides - returns 200 and the updated routing config data', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(user1);
+      const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         cascade: [
@@ -394,11 +410,12 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
 
       const start = new Date();
 
-      const updateResponse = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const updateResponse = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -411,9 +428,10 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
       expect(updated).toEqual({
         statusCode: 200,
         data: {
-          ...routingConfig.apiResponse,
+          ...apiResponse,
           ...update,
           updatedAt: expect.stringMatching(isoDateRegExp),
+          lockNumber: dbEntry.lockNumber + 1,
         },
       });
 
@@ -421,15 +439,15 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
         start,
         new Date(),
       ]);
-      expect(updated.data.createdAt).toEqual(routingConfig.dbEntry.createdAt);
+      expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
     });
 
     test('cascade without cascadeGroupOverrides - returns 400', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(user1);
+      const { dbEntry } = RoutingConfigFactory.create(user1);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         cascade: [
@@ -442,11 +460,12 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
         ],
       };
 
-      const updateResponse = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const updateResponse = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -469,19 +488,20 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     test('cascadeGroupOverrides without cascade - returns 400', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(user1);
+      const { dbEntry } = RoutingConfigFactory.create(user1);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         cascadeGroupOverrides: [{ name: 'standard' }],
       };
 
-      const response = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const response = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -500,17 +520,18 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
     });
 
     test('empty payload - returns 400', async ({ request }) => {
-      const routingConfig = RoutingConfigFactory.create(user1);
+      const { dbEntry } = RoutingConfigFactory.create(user1);
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {};
 
-      const response = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+      const response = await request.patch(
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -527,4 +548,61 @@ test.describe('PUT /v1/routing-configuration/:routingConfigId', () => {
       });
     });
   });
+
+  test('returns 409 if the lock number header is not set', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+        },
+        data: {
+          name: 'new name',
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
+
+  test('returns 409 if the lock number header does not match the current one', async ({
+    request,
+  }) => {
+    const { dbEntry } = RoutingConfigFactory.create(user1);
+
+    await storageHelper.seed([dbEntry]);
+
+    const response = await request.patch(
+      `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
+      {
+        headers: {
+          Authorization: await user1.getAccessToken(),
+          'X-Lock-Number': String(dbEntry.lockNumber + 1),
+        },
+        data: {
+          name: 'new name',
+        },
+      }
+    );
+
+    expect(response.status()).toBe(409);
+
+    expect(await response.json()).toEqual({
+      statusCode: 409,
+      technicalMessage:
+        'Lock number mismatch - Message Plan has been modified since last read',
+    });
+  });
 });
diff --git a/tests/test-team/template-mgmt-api-tests/update-template.api.spec.ts b/tests/test-team/template-mgmt-api-tests/update-template.api.spec.ts
index e851ec279..02ca27b7e 100644
--- a/tests/test-team/template-mgmt-api-tests/update-template.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/update-template.api.spec.ts
@@ -2100,7 +2100,8 @@ test.describe('PUT /v1/template/:templateId', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 
@@ -2145,7 +2146,8 @@ test.describe('PUT /v1/template/:templateId', () => {
 
     expect(body).toEqual({
       statusCode: 409,
-      technicalMessage: 'Invalid lock number',
+      technicalMessage:
+        'Lock number mismatch - Template has been modified since last read',
     });
   });
 });
diff --git a/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts b/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
index 01bdba11d..5390c408f 100644
--- a/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
+++ b/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
@@ -332,4 +332,62 @@ describe('RoutingConfigUpdateBuilder', () => {
       });
     });
   });
+
+  describe('expectLockNumber', () => {
+    test('adds condition for existing lock number', () => {
+      const builder = new RoutingConfigUpdateBuilder(
+        mockTableName,
+        mockOwner,
+        mockId
+      );
+
+      const res = builder.setStatus('COMPLETED').expectLockNumber(5).build();
+
+      expect(res).toEqual({
+        ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
+          '#status': 'status',
+        },
+        ExpressionAttributeValues: {
+          ':condition_1_1_lockNumber': 5,
+          ':status': 'COMPLETED',
+        },
+        ConditionExpression:
+          '(#lockNumber = :condition_1_1_lockNumber OR attribute_not_exists (#lockNumber))',
+        Key: {
+          id: mockId,
+          owner: mockOwnerKey,
+        },
+        TableName: 'TABLE_NAME',
+        UpdateExpression: 'SET #status = :status',
+      });
+    });
+  });
+
+  describe('incrementLockNumber', () => {
+    test('increments lock number by 1', () => {
+      const builder = new RoutingConfigUpdateBuilder(
+        mockTableName,
+        mockOwner,
+        mockId
+      );
+
+      const res = builder.incrementLockNumber().build();
+
+      expect(res).toEqual({
+        ExpressionAttributeNames: {
+          '#lockNumber': 'lockNumber',
+        },
+        ExpressionAttributeValues: {
+          ':lockNumber': 1,
+        },
+        Key: {
+          id: mockId,
+          owner: mockOwnerKey,
+        },
+        TableName: 'TABLE_NAME',
+        UpdateExpression: 'ADD #lockNumber :lockNumber',
+      });
+    });
+  });
 });
diff --git a/utils/entity-update-command-builder/src/routing-config-update-builder.ts b/utils/entity-update-command-builder/src/routing-config-update-builder.ts
index 818b068dc..ebb366a28 100644
--- a/utils/entity-update-command-builder/src/routing-config-update-builder.ts
+++ b/utils/entity-update-command-builder/src/routing-config-update-builder.ts
@@ -79,6 +79,21 @@ export class RoutingConfigUpdateBuilder extends EntityUpdateBuilder<
     return this;
   }
 
+  expectLockNumber(lockNumber: number) {
+    this.updateBuilder.conditions.andGroup((group) => {
+      group
+        .and('lockNumber', '=', lockNumber)
+        .orFn('attribute_not_exists', 'lockNumber');
+    });
+
+    return this;
+  }
+
+  incrementLockNumber() {
+    this.updateBuilder.addToValue('lockNumber', 1);
+    return this;
+  }
+
   build() {
     return this.updateBuilder.finalise();
   }
diff --git a/utils/utils/src/types.ts b/utils/utils/src/types.ts
index b0a0a081d..b5b386f48 100644
--- a/utils/utils/src/types.ts
+++ b/utils/utils/src/types.ts
@@ -62,6 +62,7 @@ export type TemplatePageProps = {
   params: Promise<{
     templateId: string;
   }>;
+  searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 };
 
 export type MessagePlanPageProps = {

From e674448d135a369832533c576131178340d5726e Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Mon, 17 Nov 2025 17:04:07 +0000
Subject: [PATCH 02/11] CCM-12744: tests

---
 .../request-proof-of-template/page.test.tsx   | 31 ++++++-
 .../app/submit-email-template/page.test.tsx   | 19 ++++-
 .../app/submit-letter-template/page.test.tsx  | 19 ++++-
 .../app/submit-nhs-app-template/page.test.tsx | 25 +++++-
 .../page.test.tsx                             | 19 ++++-
 .../src/__tests__/utils/message-plans.test.ts |  2 +-
 .../[routingConfigId]/actions.test.ts         |  7 +-
 .../[templateId]/page.tsx                     | 14 +++-
 .../[templateId]/page.tsx                     | 14 +++-
 .../[templateId]/page.tsx                     | 14 +++-
 .../helpers/template-mgmt-common.steps.ts     | 83 ++++++++++++++-----
 .../template-mgmt-submit-letter-page.ts       |  6 +-
 .../pages/routing/create-message-plan-page.ts |  6 +-
 .../pages/template-mgmt-base-page-dynamic.ts  | 24 ++++--
 .../template-mgmt-base-page-non-dynamic.ts    | 17 ++--
 .../pages/template-mgmt-base-page.ts          |  8 --
 .../pages/template-mgmt-request-proof-page.ts |  6 +-
 .../routing.accessibility.spec.ts             | 15 +---
 ...mgmt-preview-letter-page.component.spec.ts | 21 ++++-
 ...-mgmt-request-proof-page.component.spec.ts | 20 ++++-
 .../template-mgmt-submit-common.steps.ts      |  4 +-
 ...emplate-mgmt-submit-page.component.spec.ts | 47 ++++++++---
 ...choose-templates.routing-component.spec.ts | 10 +--
 ...ate-message-plan.routing-component.spec.ts | 51 ++++++------
 24 files changed, 359 insertions(+), 123 deletions(-)

diff --git a/frontend/src/__tests__/app/request-proof-of-template/page.test.tsx b/frontend/src/__tests__/app/request-proof-of-template/page.test.tsx
index 926a1ea61..7fcffbab9 100644
--- a/frontend/src/__tests__/app/request-proof-of-template/page.test.tsx
+++ b/frontend/src/__tests__/app/request-proof-of-template/page.test.tsx
@@ -50,7 +50,7 @@ describe('RequestProofPage', () => {
           fileName: 'a.pdf',
         },
       },
-      lockNumber: 1,
+      lockNumber: 0,
     } satisfies Partial<TemplateDto>;
 
     getTemplateMock.mockResolvedValue({
@@ -63,6 +63,9 @@ describe('RequestProofPage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({
+        lockNumber: '42',
+      }),
     });
 
     expect(await generateMetadata()).toEqual({
@@ -74,7 +77,7 @@ describe('RequestProofPage', () => {
         templateName={state.name}
         templateId={state.id}
         channel='LETTER'
-        lockNumber={state.lockNumber}
+        lockNumber={42}
       />
     );
   });
@@ -86,6 +89,7 @@ describe('RequestProofPage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -108,6 +112,9 @@ describe('RequestProofPage', () => {
         params: Promise.resolve({
           templateId: 'template-id',
         }),
+        searchParams: Promise.resolve({
+          lockNumber: '42',
+        }),
       });
 
       expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -122,6 +129,9 @@ describe('RequestProofPage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({
+        lockNumber: '42',
+      }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -156,6 +166,9 @@ describe('RequestProofPage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({
+        lockNumber: '42',
+      }),
     });
 
     expect(await generateMetadata()).toEqual({
@@ -164,4 +177,18 @@ describe('RequestProofPage', () => {
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
   });
+
+  test('should redirect to template preview page when lockNumber search parameter is missing', async () => {
+    await RequestProofPage({
+      params: Promise.resolve({
+        templateId: 'template-id',
+      }),
+      searchParams: Promise.resolve({}),
+    });
+
+    expect(redirectMock).toHaveBeenCalledWith(
+      '/preview-letter-template/template-id',
+      'replace'
+    );
+  });
 });
diff --git a/frontend/src/__tests__/app/submit-email-template/page.test.tsx b/frontend/src/__tests__/app/submit-email-template/page.test.tsx
index 00ab2dd58..615f2242b 100644
--- a/frontend/src/__tests__/app/submit-email-template/page.test.tsx
+++ b/frontend/src/__tests__/app/submit-email-template/page.test.tsx
@@ -48,6 +48,7 @@ describe('SubmitEmailTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(await generateMetadata()).toEqual({
@@ -58,7 +59,7 @@ describe('SubmitEmailTemplatePage', () => {
         templateName={state.name}
         templateId={state.id}
         channel='EMAIL'
-        lockNumber={state.lockNumber}
+        lockNumber={42}
       />
     );
   });
@@ -70,6 +71,7 @@ describe('SubmitEmailTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -103,9 +105,24 @@ describe('SubmitEmailTemplatePage', () => {
         params: Promise.resolve({
           templateId: 'template-id',
         }),
+        searchParams: Promise.resolve({ lockNumber: '42' }),
       });
 
       expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
     }
   );
+
+  test('it should redirect to preview page if lockNumber search param is invalid', async () => {
+    await SubmitEmailTemplatePage({
+      params: Promise.resolve({
+        templateId: 'template-id',
+      }),
+      searchParams: Promise.resolve({}),
+    });
+
+    expect(redirectMock).toHaveBeenCalledWith(
+      '/preview-email-template/template-id',
+      'replace'
+    );
+  });
 });
diff --git a/frontend/src/__tests__/app/submit-letter-template/page.test.tsx b/frontend/src/__tests__/app/submit-letter-template/page.test.tsx
index b7ce8eaa9..3a5941c7e 100644
--- a/frontend/src/__tests__/app/submit-letter-template/page.test.tsx
+++ b/frontend/src/__tests__/app/submit-letter-template/page.test.tsx
@@ -39,13 +39,14 @@ describe('SubmitLetterTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(page).toEqual(
       <SubmitLetterTemplate
         templateName={LETTER_TEMPLATE.name}
         templateId={LETTER_TEMPLATE.id}
-        lockNumber={LETTER_TEMPLATE.lockNumber}
+        lockNumber={42}
       />
     );
   });
@@ -57,6 +58,7 @@ describe('SubmitLetterTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'invalid-template',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -89,12 +91,27 @@ describe('SubmitLetterTemplatePage', () => {
         params: Promise.resolve({
           templateId: 'template-id',
         }),
+        searchParams: Promise.resolve({ lockNumber: '42' }),
       });
 
       expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
     }
   );
 
+  test('should redirect to template preview when lock number search parameter is invalid', async () => {
+    await SubmitLetterTemplatePage({
+      params: Promise.resolve({
+        templateId: 'template-id',
+      }),
+      searchParams: Promise.resolve({}),
+    });
+
+    expect(redirectMock).toHaveBeenCalledWith(
+      '/preview-letter-template/template-id',
+      'replace'
+    );
+  });
+
   test('should generate metadata', async () => {
     const metadata = await generateMetadata();
 
diff --git a/frontend/src/__tests__/app/submit-nhs-app-template/page.test.tsx b/frontend/src/__tests__/app/submit-nhs-app-template/page.test.tsx
index 48eccd8a6..9dfc4fe07 100644
--- a/frontend/src/__tests__/app/submit-nhs-app-template/page.test.tsx
+++ b/frontend/src/__tests__/app/submit-nhs-app-template/page.test.tsx
@@ -48,6 +48,9 @@ describe('SubmitNhsAppTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({
+        lockNumber: '42',
+      }),
     });
 
     expect(await generateMetadata()).toEqual({
@@ -58,7 +61,7 @@ describe('SubmitNhsAppTemplatePage', () => {
         templateName={state.name}
         templateId={state.id}
         channel='NHS_APP'
-        lockNumber={state.lockNumber}
+        lockNumber={42}
       />
     );
   });
@@ -70,6 +73,9 @@ describe('SubmitNhsAppTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({
+        lockNumber: '42',
+      }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -101,9 +107,26 @@ describe('SubmitNhsAppTemplatePage', () => {
         params: Promise.resolve({
           templateId: 'template-id',
         }),
+        searchParams: Promise.resolve({
+          lockNumber: '42',
+        }),
       });
 
       expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
     }
   );
+
+  test('it should redirect to preview page if lockNumber search param is invalid', async () => {
+    await SubmitNhsAppTemplatePage({
+      params: Promise.resolve({
+        templateId: 'template-id',
+      }),
+      searchParams: Promise.resolve({}),
+    });
+
+    expect(redirectMock).toHaveBeenCalledWith(
+      '/preview-nhs-app-template/template-id',
+      'replace'
+    );
+  });
 });
diff --git a/frontend/src/__tests__/app/submit-text-message-template/page.test.tsx b/frontend/src/__tests__/app/submit-text-message-template/page.test.tsx
index 872df527e..5fd942098 100644
--- a/frontend/src/__tests__/app/submit-text-message-template/page.test.tsx
+++ b/frontend/src/__tests__/app/submit-text-message-template/page.test.tsx
@@ -48,6 +48,7 @@ describe('SubmitSmsTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'template-id',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(await generateMetadata()).toEqual({
@@ -58,7 +59,7 @@ describe('SubmitSmsTemplatePage', () => {
         templateName={state.name}
         templateId={state.id}
         channel='SMS'
-        lockNumber={state.lockNumber}
+        lockNumber={42}
       />
     );
   });
@@ -70,6 +71,7 @@ describe('SubmitSmsTemplatePage', () => {
       params: Promise.resolve({
         templateId: 'invalid-template',
       }),
+      searchParams: Promise.resolve({ lockNumber: '42' }),
     });
 
     expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
@@ -101,9 +103,24 @@ describe('SubmitSmsTemplatePage', () => {
         params: Promise.resolve({
           templateId: 'template-id',
         }),
+        searchParams: Promise.resolve({ lockNumber: '42' }),
       });
 
       expect(redirectMock).toHaveBeenCalledWith('/invalid-template', 'replace');
     }
   );
+
+  test('it should redirect to preview page if lockNumber search param is invalid', async () => {
+    await SubmitSmsTemplatePage({
+      params: Promise.resolve({
+        templateId: 'template-id',
+      }),
+      searchParams: Promise.resolve({}),
+    });
+
+    expect(redirectMock).toHaveBeenCalledWith(
+      '/preview-text-message-template/template-id',
+      'replace'
+    );
+  });
 });
diff --git a/frontend/src/__tests__/utils/message-plans.test.ts b/frontend/src/__tests__/utils/message-plans.test.ts
index adc705d48..3e5aea507 100644
--- a/frontend/src/__tests__/utils/message-plans.test.ts
+++ b/frontend/src/__tests__/utils/message-plans.test.ts
@@ -419,7 +419,7 @@ describe('Message plans actions', () => {
       );
       expect(response).toBeUndefined();
       expect(loggerMock.error).toHaveBeenCalledWith(
-        'Failed to get routing configuration',
+        'Failed to update routing configuration',
         expect.objectContaining({
           errorMeta: expect.objectContaining({ code: 400 }),
         })
diff --git a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
index 5aa89d8ef..15be79a5c 100644
--- a/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
+++ b/frontend/src/app/message-plans/choose-templates/[routingConfigId]/actions.test.ts
@@ -55,6 +55,7 @@ describe('removeTemplateFromMessagePlan', () => {
     const formData = new FormData();
     formData.set('routingConfigId', routingConfigId);
     formData.set('channel', 'EMAIL');
+    formData.set('lockNumber', '42');
 
     await removeTemplateFromMessagePlan(formData);
 
@@ -73,7 +74,8 @@ describe('removeTemplateFromMessagePlan', () => {
             defaultTemplateId: 'template-2',
           }),
         ],
-      })
+      }),
+      42
     );
   });
 
@@ -84,6 +86,7 @@ describe('removeTemplateFromMessagePlan', () => {
     const formData = new FormData();
     formData.set('routingConfigId', routingConfigId);
     formData.set('channel', 'EMAIL');
+    formData.set('lockNumber', '42');
 
     await removeTemplateFromMessagePlan(formData);
 
@@ -98,6 +101,7 @@ describe('removeTemplateFromMessagePlan', () => {
     const formData = new FormData();
     formData.set('routingConfigId', routingConfigId);
     formData.set('channel', 'EMAIL');
+    formData.set('lockNumber', '42');
 
     await expect(removeTemplateFromMessagePlan(formData)).rejects.toThrow(
       /not found/
@@ -116,6 +120,7 @@ describe('removeTemplateFromMessagePlan', () => {
     const formData = new FormData();
     formData.set('routingConfigId', 'invalid-id');
     formData.set('channel', 'test');
+    formData.set('lockNumber', '42');
 
     await expect(removeTemplateFromMessagePlan(formData)).rejects.toThrow(
       /Invalid form data/
diff --git a/frontend/src/app/submit-email-template/[templateId]/page.tsx b/frontend/src/app/submit-email-template/[templateId]/page.tsx
index ecfbe94b6..f5cd45159 100644
--- a/frontend/src/app/submit-email-template/[templateId]/page.tsx
+++ b/frontend/src/app/submit-email-template/[templateId]/page.tsx
@@ -2,6 +2,7 @@
 
 import { Metadata } from 'next';
 import { redirect, RedirectType } from 'next/navigation';
+import { $LockNumber } from 'nhs-notify-backend-client';
 import { SubmitDigitalTemplate } from '@forms/SubmitTemplate/SubmitDigitalTemplate';
 import {
   TemplatePageProps,
@@ -21,6 +22,17 @@ export async function generateMetadata(): Promise<Metadata> {
 const SubmitEmailTemplatePage = async (props: TemplatePageProps) => {
   const { templateId } = await props.params;
 
+  const searchParams = await props.searchParams;
+
+  const lockNumberResult = $LockNumber.safeParse(searchParams.lockNumber);
+
+  if (!lockNumberResult.success) {
+    return redirect(
+      `/preview-email-template/${templateId}`,
+      RedirectType.replace
+    );
+  }
+
   const template = await getTemplate(templateId);
 
   const validatedTemplate = validateEmailTemplate(template);
@@ -33,7 +45,7 @@ const SubmitEmailTemplatePage = async (props: TemplatePageProps) => {
     <SubmitDigitalTemplate
       templateName={validatedTemplate.name}
       templateId={validatedTemplate.id}
-      lockNumber={validatedTemplate.lockNumber}
+      lockNumber={lockNumberResult.data}
       channel='EMAIL'
     />
   );
diff --git a/frontend/src/app/submit-nhs-app-template/[templateId]/page.tsx b/frontend/src/app/submit-nhs-app-template/[templateId]/page.tsx
index fe524e64d..8b9235655 100644
--- a/frontend/src/app/submit-nhs-app-template/[templateId]/page.tsx
+++ b/frontend/src/app/submit-nhs-app-template/[templateId]/page.tsx
@@ -2,6 +2,7 @@
 
 import { Metadata } from 'next';
 import { redirect, RedirectType } from 'next/navigation';
+import { $LockNumber } from 'nhs-notify-backend-client';
 import { SubmitDigitalTemplate } from '@forms/SubmitTemplate/SubmitDigitalTemplate';
 import {
   TemplatePageProps,
@@ -21,6 +22,17 @@ export async function generateMetadata(): Promise<Metadata> {
 const SubmitNhsAppTemplatePage = async (props: TemplatePageProps) => {
   const { templateId } = await props.params;
 
+  const searchParams = await props.searchParams;
+
+  const lockNumberResult = $LockNumber.safeParse(searchParams.lockNumber);
+
+  if (!lockNumberResult.success) {
+    return redirect(
+      `/preview-nhs-app-template/${templateId}`,
+      RedirectType.replace
+    );
+  }
+
   const template = await getTemplate(templateId);
 
   const validatedTemplate = validateNHSAppTemplate(template);
@@ -34,7 +46,7 @@ const SubmitNhsAppTemplatePage = async (props: TemplatePageProps) => {
       templateName={validatedTemplate.name}
       templateId={validatedTemplate.id}
       channel='NHS_APP'
-      lockNumber={validatedTemplate.lockNumber}
+      lockNumber={lockNumberResult.data}
     />
   );
 };
diff --git a/frontend/src/app/submit-text-message-template/[templateId]/page.tsx b/frontend/src/app/submit-text-message-template/[templateId]/page.tsx
index 7be99331b..2eece743e 100644
--- a/frontend/src/app/submit-text-message-template/[templateId]/page.tsx
+++ b/frontend/src/app/submit-text-message-template/[templateId]/page.tsx
@@ -2,6 +2,7 @@
 
 import { Metadata } from 'next';
 import { redirect, RedirectType } from 'next/navigation';
+import { $LockNumber } from 'nhs-notify-backend-client';
 import { SubmitDigitalTemplate } from '@forms/SubmitTemplate/SubmitDigitalTemplate';
 import {
   TemplatePageProps,
@@ -21,6 +22,17 @@ export async function generateMetadata(): Promise<Metadata> {
 const SubmitSmsTemplatePage = async (props: TemplatePageProps) => {
   const { templateId } = await props.params;
 
+  const searchParams = await props.searchParams;
+
+  const lockNumberResult = $LockNumber.safeParse(searchParams.lockNumber);
+
+  if (!lockNumberResult.success) {
+    return redirect(
+      `/preview-text-message-template/${templateId}`,
+      RedirectType.replace
+    );
+  }
+
   const template = await getTemplate(templateId);
 
   const validatedTemplate = validateSMSTemplate(template);
@@ -34,7 +46,7 @@ const SubmitSmsTemplatePage = async (props: TemplatePageProps) => {
       templateName={validatedTemplate.name}
       templateId={validatedTemplate.id}
       channel='SMS'
-      lockNumber={validatedTemplate.lockNumber}
+      lockNumber={lockNumberResult.data}
     />
   );
 };
diff --git a/tests/test-team/helpers/template-mgmt-common.steps.ts b/tests/test-team/helpers/template-mgmt-common.steps.ts
index c0c12abdc..71689ec77 100644
--- a/tests/test-team/helpers/template-mgmt-common.steps.ts
+++ b/tests/test-team/helpers/template-mgmt-common.steps.ts
@@ -1,10 +1,12 @@
 import { test, expect } from '@playwright/test';
-import { TemplateMgmtBasePage } from '../pages/template-mgmt-base-page';
+import { TemplateMgmtBasePageDynamic } from 'pages/template-mgmt-base-page-dynamic';
+import type { TemplateMgmtBasePageNonDynamic } from 'pages/template-mgmt-base-page-non-dynamic';
 
 type CommonStepsProps = {
-  page: TemplateMgmtBasePage;
+  page: TemplateMgmtBasePageDynamic | TemplateMgmtBasePageNonDynamic;
   id?: string;
   baseURL?: string;
+  search?: Record<string, string>;
 };
 
 type FooterLinkSpec = {
@@ -35,9 +37,15 @@ const expectedFooterLinks: Record<string, FooterLinkSpec> = {
   },
 };
 
-export function assertSkipToMainContent({ page, id }: CommonStepsProps) {
+export function assertSkipToMainContent({
+  page,
+  id,
+  search,
+}: CommonStepsProps) {
   return test.step('when user clicks "skip to main content", then page heading is focused', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await page.page.keyboard.press('Tab');
 
@@ -55,9 +63,15 @@ export function assertSkipToMainContent({ page, id }: CommonStepsProps) {
   });
 }
 
-export function assertHeaderWhenSignedOut({ page, id }: CommonStepsProps) {
+export function assertHeaderWhenSignedOut({
+  page,
+  id,
+  search,
+}: CommonStepsProps) {
   return test.step('when user is signed out, then header displays sign in link only', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await expect(page.signInLink).toBeVisible();
     await expect(page.signOutLink).toBeHidden();
@@ -72,12 +86,15 @@ export function assertHeaderWhenSignedIn({
   id,
   expectedDisplayName,
   expectedClientName,
+  search,
 }: CommonStepsProps & {
   expectedDisplayName: string;
   expectedClientName: string;
 }) {
   return test.step('when user is signed in, then header shows display name and client name', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await expect(page.signOutLink).toBeVisible();
     await expect(page.signInLink).toBeHidden();
@@ -96,9 +113,11 @@ export function assertHeaderWhenSignedIn({
   });
 }
 
-export function assertHeaderLogoLink({ page, id }: CommonStepsProps) {
+export function assertHeaderLogoLink({ page, id, search }: CommonStepsProps) {
   return test.step('header logo is visible, correctly labelled and structured', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     const logoLink = page.headerLogoLink;
 
@@ -122,9 +141,10 @@ export function assertClickHeaderLogoRedirectsToStartPage({
   page,
   id,
   baseURL,
+  search,
 }: CommonStepsProps) {
   return test.step('when user clicks header logo, they are redirected to start page', async () => {
-    await assertHeaderLogoLink({ page, id });
+    await assertHeaderLogoLink({ page, id, search });
 
     await page.headerLogoLink.click();
 
@@ -134,9 +154,11 @@ export function assertClickHeaderLogoRedirectsToStartPage({
   });
 }
 
-export function assertSignInLink({ page, id }: CommonStepsProps) {
+export function assertSignInLink({ page, id, search }: CommonStepsProps) {
   return test.step('when user clicks "Sign in", then user is redirected to "sign in page"', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     const link = page.signInLink;
 
@@ -147,9 +169,11 @@ export function assertSignInLink({ page, id }: CommonStepsProps) {
   });
 }
 
-export function assertSignOutLink({ page, id }: CommonStepsProps) {
+export function assertSignOutLink({ page, id, search }: CommonStepsProps) {
   return test.step('"Sign out", should direct user to signout', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     const link = page.signOutLink;
 
@@ -161,13 +185,16 @@ export function assertHeaderNavigationLinksWhenSignedIn({
   page,
   id,
   routingEnabled,
+  search,
 }: CommonStepsProps & { routingEnabled: boolean }) {
   const description = routingEnabled
     ? 'Templates and Message plans links'
     : 'Templates link only';
 
   return test.step(`header shows ${description} when routing is ${routingEnabled ? 'enabled' : 'disabled'}`, async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     const nav = page.headerNavigationLinks;
 
@@ -184,9 +211,12 @@ export function assertHeaderNavigationLinksWhenSignedIn({
 export function assertHeaderNavigationLinksWhenSignedOut({
   page,
   id,
+  search,
 }: CommonStepsProps) {
   return test.step('header does not display navigation links when signed out', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await expect(page.headerNavigationLinks).toHaveCount(0);
   });
@@ -197,9 +227,12 @@ export function assertGoBackLink({
   id,
   baseURL,
   expectedUrl,
+  search,
 }: CommonStepsProps & { expectedUrl: string }) {
   return test.step('when user clicks "Go back", then user is redirected to previous page', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await page.goBackLink.click();
 
@@ -209,17 +242,25 @@ export function assertGoBackLink({
   });
 }
 
-export function assertGoBackLinkNotPresent({ page, id }: CommonStepsProps) {
+export function assertGoBackLinkNotPresent({
+  page,
+  id,
+  search,
+}: CommonStepsProps) {
   return test.step('should not display "Go Back" link on page', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     await expect(page.goBackLink).toBeHidden();
   });
 }
 
-export function assertFooterLinks({ page, id }: CommonStepsProps) {
+export function assertFooterLinks({ page, id, search }: CommonStepsProps) {
   return test.step('when page loads, then Page Footer should have the correct links', async () => {
-    await page.loadPage(id);
+    await (page instanceof TemplateMgmtBasePageDynamic
+      ? page.loadPage(id, search)
+      : page.loadPage(search));
 
     const promises = Object.values(expectedFooterLinks).map((linkSpec) =>
       expect(
diff --git a/tests/test-team/pages/letter/template-mgmt-submit-letter-page.ts b/tests/test-team/pages/letter/template-mgmt-submit-letter-page.ts
index e7fa0d7f5..72b37f697 100644
--- a/tests/test-team/pages/letter/template-mgmt-submit-letter-page.ts
+++ b/tests/test-team/pages/letter/template-mgmt-submit-letter-page.ts
@@ -4,6 +4,10 @@ export class TemplateMgmtSubmitLetterPage extends TemplateMgmtSubmitBasePage {
   static readonly pageUrlSegment = 'submit-letter-template';
 
   public static readonly urlRegexp = new RegExp(
-    /\/templates\/submit-letter-template\/([\dA-Fa-f-]+)$/
+    /\/templates\/submit-letter-template\/([\dA-Fa-f-]+)\?lockNumber=\d+$/
   );
+
+  public static url(id: string, lockNumber: number) {
+    return `/templates/${this.pageUrlSegment}/${id}?lockNumber=${lockNumber}`;
+  }
 }
diff --git a/tests/test-team/pages/routing/create-message-plan-page.ts b/tests/test-team/pages/routing/create-message-plan-page.ts
index c3a0c46b2..c6efa186f 100644
--- a/tests/test-team/pages/routing/create-message-plan-page.ts
+++ b/tests/test-team/pages/routing/create-message-plan-page.ts
@@ -18,7 +18,7 @@ export class RoutingCreateMessagePlanPage extends TemplateMgmtBasePageNonDynamic
 
   readonly singleCampaignIdElement: Locator;
 
-  constructor(page: Page, queryParameters?: { messageOrder: string }) {
+  constructor(page: Page) {
     super(page);
     this.submitButton = page.getByTestId('submit-button');
     this.goBackLink = page.getByTestId('go-back-link');
@@ -26,10 +26,6 @@ export class RoutingCreateMessagePlanPage extends TemplateMgmtBasePageNonDynamic
     this.campaignIdSelector = page.getByTestId('campaign-id-field');
     this.singleCampaignIdElement = page.getByTestId('single-campaign-id');
 
-    if (queryParameters) {
-      this.queryParameters = new URLSearchParams(queryParameters);
-    }
-
     this.nameFieldError = page.locator('#name--error-message');
 
     this.campaignIdFieldError = page.locator('#campaignId--error-message');
diff --git a/tests/test-team/pages/template-mgmt-base-page-dynamic.ts b/tests/test-team/pages/template-mgmt-base-page-dynamic.ts
index d4bff1ceb..22c4c28f5 100644
--- a/tests/test-team/pages/template-mgmt-base-page-dynamic.ts
+++ b/tests/test-team/pages/template-mgmt-base-page-dynamic.ts
@@ -1,14 +1,10 @@
-import { type Page } from '@playwright/test';
 import { TemplateMgmtBasePage } from './template-mgmt-base-page';
 
 export abstract class TemplateMgmtBasePageDynamic extends TemplateMgmtBasePage {
-  static readonly dynamicPage = true;
-
-  constructor(page: Page) {
-    super(page);
-  }
-
-  async loadPage(idParameter: string) {
+  async loadPage(
+    idParameter?: string,
+    searchParameters?: Record<string, string>
+  ) {
     const { appUrlSegment, pageUrlSegment } = this
       .constructor as typeof TemplateMgmtBasePageDynamic;
 
@@ -16,7 +12,13 @@ export abstract class TemplateMgmtBasePageDynamic extends TemplateMgmtBasePage {
       throw new Error('pageUrlSegment is not defined');
     }
 
-    await this.navigateTo(`/${appUrlSegment}/${pageUrlSegment}/${idParameter}`);
+    let url = `/${appUrlSegment}/${pageUrlSegment}/${idParameter}`;
+
+    if (searchParameters && Object.keys(searchParameters).length > 0) {
+      url += `?${new URLSearchParams(searchParameters).toString()}`;
+    }
+
+    await this.navigateTo(url);
   }
 
   getIdFromUrl(): string | undefined {
@@ -30,4 +32,8 @@ export abstract class TemplateMgmtBasePageDynamic extends TemplateMgmtBasePage {
     const id = match ? match[1] : undefined;
     return id;
   }
+
+  async attemptToLoadPageExpectFailure(idParameter: string) {
+    await this.loadPage(idParameter);
+  }
 }
diff --git a/tests/test-team/pages/template-mgmt-base-page-non-dynamic.ts b/tests/test-team/pages/template-mgmt-base-page-non-dynamic.ts
index 431f75d02..ed5429f8e 100644
--- a/tests/test-team/pages/template-mgmt-base-page-non-dynamic.ts
+++ b/tests/test-team/pages/template-mgmt-base-page-non-dynamic.ts
@@ -1,14 +1,7 @@
-import { type Page } from '@playwright/test';
 import { TemplateMgmtBasePage } from './template-mgmt-base-page';
 
 export abstract class TemplateMgmtBasePageNonDynamic extends TemplateMgmtBasePage {
-  static readonly dynamicPage = false;
-
-  constructor(page: Page) {
-    super(page);
-  }
-
-  async loadPage() {
+  async loadPage(searchParameters?: Record<string, string>) {
     const { appUrlSegment, pageUrlSegment } = this
       .constructor as typeof TemplateMgmtBasePageNonDynamic;
 
@@ -18,10 +11,14 @@ export abstract class TemplateMgmtBasePageNonDynamic extends TemplateMgmtBasePag
 
     let url = `/${appUrlSegment}/${pageUrlSegment}`;
 
-    if (this.queryParameters) {
-      url += `?${this.queryParameters.toString()}`;
+    if (searchParameters && Object.keys(searchParameters).length > 0) {
+      url += `?${new URLSearchParams(searchParameters).toString()}`;
     }
 
     await this.navigateTo(url);
   }
+
+  async attemptToLoadPageExpectFailure() {
+    await this.loadPage();
+  }
 }
diff --git a/tests/test-team/pages/template-mgmt-base-page.ts b/tests/test-team/pages/template-mgmt-base-page.ts
index 91ada3623..31e7502d1 100644
--- a/tests/test-team/pages/template-mgmt-base-page.ts
+++ b/tests/test-team/pages/template-mgmt-base-page.ts
@@ -7,8 +7,6 @@ export abstract class TemplateMgmtBasePage {
 
   static readonly pageUrlSegment: string;
 
-  queryParameters?: URLSearchParams;
-
   readonly header: Locator;
 
   readonly headerLogoLink: Locator;
@@ -69,12 +67,6 @@ export abstract class TemplateMgmtBasePage {
       .and(page.getByText('Skip to main content'));
   }
 
-  abstract loadPage(idParameter?: string): Promise<void>;
-
-  async attemptToLoadPageExpectFailure(idParameter?: string) {
-    await this.loadPage(idParameter);
-  }
-
   async navigateTo(url: string) {
     await this.page.goto(url);
   }
diff --git a/tests/test-team/pages/template-mgmt-request-proof-page.ts b/tests/test-team/pages/template-mgmt-request-proof-page.ts
index 10d871c2b..1df347617 100644
--- a/tests/test-team/pages/template-mgmt-request-proof-page.ts
+++ b/tests/test-team/pages/template-mgmt-request-proof-page.ts
@@ -5,9 +5,13 @@ export class TemplateMgmtRequestProofPage extends TemplateMgmtBasePageDynamic {
   static readonly pageUrlSegment = 'request-proof-of-template';
 
   public static readonly urlRegexp = new RegExp(
-    /\/templates\/request-proof-of-template\/([\dA-Fa-f-]+)$/
+    /\/templates\/request-proof-of-template\/([\dA-Fa-f-]+)\?lockNumber=\d+$/
   );
 
+  public static url(id: string, lockNumber: number) {
+    return `/templates/${this.pageUrlSegment}/${id}?lockNumber=${lockNumber}`;
+  }
+
   readonly requestProofButton: Locator;
 
   constructor(page: Page) {
diff --git a/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts b/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
index 82283e05f..a742e5d8b 100644
--- a/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
+++ b/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
@@ -110,18 +110,11 @@ test.describe('Routing - Accessibility', () => {
     });
 
     test('Create message plan', async ({ page, analyze }) =>
-      analyze(
-        new RoutingCreateMessagePlanPage(page, {
-          messageOrder,
-        })
-      ));
+      analyze(new RoutingCreateMessagePlanPage(page)));
 
     test('Create message plan - error', async ({ page, analyze }) =>
-      analyze(
-        new RoutingCreateMessagePlanPage(page, {
-          messageOrder,
-        }),
-        { beforeAnalyze: (p) => p.clickSubmit() }
-      ));
+      analyze(new RoutingCreateMessagePlanPage(page), {
+        beforeAnalyze: (p) => p.clickSubmit(),
+      }));
   });
 });
diff --git a/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-preview-letter-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-preview-letter-page.component.spec.ts
index 48428f22e..7a337d939 100644
--- a/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-preview-letter-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-preview-letter-page.component.spec.ts
@@ -142,7 +142,12 @@ test.describe('Preview Letter template Page', () => {
 
     await previewLetterTemplatePage.clickContinueButton();
 
-    await expect(page).toHaveURL(TemplateMgmtSubmitLetterPage.urlRegexp);
+    await expect(page).toHaveURL(
+      TemplateMgmtSubmitLetterPage.url(
+        templates.notYetSubmitted.id,
+        templates.notYetSubmitted.lockNumber
+      )
+    );
   });
 
   test('when proofingEnabled is false, user can click to go submit page', async ({
@@ -163,7 +168,12 @@ test.describe('Preview Letter template Page', () => {
 
     await previewLetterTemplatePage.clickContinueButton();
 
-    await expect(page).toHaveURL(TemplateMgmtSubmitLetterPage.urlRegexp);
+    await expect(page).toHaveURL(
+      TemplateMgmtSubmitLetterPage.url(
+        templates.proofingDisabled.id,
+        templates.proofingDisabled.lockNumber
+      )
+    );
   });
 
   test('when template is pending a proof request, user can click to go to request page', async ({
@@ -184,7 +194,12 @@ test.describe('Preview Letter template Page', () => {
 
     await previewLetterTemplatePage.clickContinueButton();
 
-    await expect(page).toHaveURL(TemplateMgmtRequestProofPage.urlRegexp);
+    await expect(page).toHaveURL(
+      TemplateMgmtRequestProofPage.url(
+        templates.pendingProofRequest.id,
+        templates.pendingProofRequest.lockNumber
+      )
+    );
   });
 
   test('when status is not actionable, no continue button is displayed', async ({
diff --git a/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-request-proof-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-request-proof-page.component.spec.ts
index 664034e54..54e8edccb 100644
--- a/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-request-proof-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/letter/template-mgmt-request-proof-page.component.spec.ts
@@ -6,6 +6,7 @@ import {
   testUsers,
 } from '../../helpers/auth/cognito-auth-helper';
 import { TemplateMgmtRequestProofPage } from '../../pages/template-mgmt-request-proof-page';
+import { TemplateMgmtPreviewLetterPage } from 'pages/letter/template-mgmt-preview-letter-page';
 
 async function createTemplates() {
   const user = await createAuthHelper().getTestUser(testUsers.User1.userId);
@@ -38,10 +39,12 @@ test.describe('Request Proof Page', () => {
   }) => {
     const requestProofPage = new TemplateMgmtRequestProofPage(page);
 
-    await requestProofPage.loadPage(templates.valid.id);
+    await requestProofPage.loadPage(templates.valid.id, {
+      lockNumber: String(templates.valid.lockNumber),
+    });
 
     await expect(page).toHaveURL(
-      `${baseURL}/templates/${TemplateMgmtRequestProofPage.pageUrlSegment}/${templates.valid.id}`
+      `${baseURL}/templates/${TemplateMgmtRequestProofPage.pageUrlSegment}/${templates.valid.id}?lockNumber=${templates.valid.lockNumber}`
     );
 
     await expect(requestProofPage.pageHeading).toContainText(
@@ -50,4 +53,17 @@ test.describe('Request Proof Page', () => {
 
     await expect(requestProofPage.requestProofButton).toBeVisible();
   });
+
+  test('redirects to the letter template preview page if the lockNumber query parameter is not set', async ({
+    page,
+    baseURL,
+  }) => {
+    const requestProofPage = new TemplateMgmtRequestProofPage(page);
+
+    await requestProofPage.loadPage(templates.valid.id);
+
+    await expect(page).toHaveURL(
+      `${baseURL}/templates/${TemplateMgmtPreviewLetterPage.pageUrlSegment}/${templates.valid.id}`
+    );
+  });
 });
diff --git a/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-common.steps.ts b/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-common.steps.ts
index 894dedbd4..e3c0c1a0a 100644
--- a/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-common.steps.ts
+++ b/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-common.steps.ts
@@ -5,6 +5,7 @@ type CommonStepsProps = {
   page: TemplateMgmtSubmitBasePage;
   id: string;
   baseURL?: string;
+  search?: Record<string, string>;
 };
 
 export function assertGoBackButton({
@@ -12,9 +13,10 @@ export function assertGoBackButton({
   id,
   baseURL,
   expectedUrl,
+  search,
 }: CommonStepsProps & { expectedUrl: string }) {
   return test.step('when user clicks "Go back" button, then user is redirected to previous page', async () => {
-    await page.loadPage(id);
+    await page.loadPage(id, search);
 
     await page.clickGoBackButton();
 
diff --git a/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-page.component.spec.ts
index 583a43250..6975bf5a3 100644
--- a/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/template-mgmt-submit-page.component.spec.ts
@@ -212,10 +212,14 @@ test.describe('Submit template Page', () => {
     }) => {
       const submitTemplatePage = new PageModel(page);
 
-      await submitTemplatePage.loadPage(templates[channelIdentifier].valid.id);
+      const template = templates[channelIdentifier].valid;
+
+      await submitTemplatePage.loadPage(template.id, {
+        lockNumber: String(template.lockNumber),
+      });
 
       await expect(page).toHaveURL(
-        `${baseURL}/templates/submit-${channelIdentifier}-template/${templates[channelIdentifier].valid.id}`
+        `${baseURL}/templates/submit-${channelIdentifier}-template/${template.id}?lockNumber=${template.lockNumber}`
       );
 
       await expect(submitTemplatePage.pageHeading).toHaveText(expectedHeading);
@@ -224,10 +228,12 @@ test.describe('Submit template Page', () => {
     // eslint-disable-next-line no-loop-func
     test.describe('Page functionality', () => {
       test(`common ${channelName} page tests`, async ({ page, baseURL }) => {
+        const template = templates[channelIdentifier].valid;
         const props = {
           page: new PageModel(page),
-          id: templates[channelIdentifier].valid.id,
+          id: template.id,
           baseURL,
+          search: { lockNumber: String(template.lockNumber) },
         };
 
         await assertSkipToMainContent(props);
@@ -236,18 +242,19 @@ test.describe('Submit template Page', () => {
         await assertFooterLinks(props);
         await assertGoBackButton({
           ...props,
-          expectedUrl: `templates/preview-${channelIdentifier}-template/${templates[channelIdentifier].valid.id}`,
+          expectedUrl: `templates/preview-${channelIdentifier}-template/${template.id}`,
         });
       });
 
       test(`when user submits form, then the ${channelName} "Template submitted" page is displayed`, async ({
         page,
       }) => {
+        const template = templates[channelIdentifier].submit;
         const submitTemplatePage = new PageModel(page);
 
-        await submitTemplatePage.loadPage(
-          templates[channelIdentifier].submit.id
-        );
+        await submitTemplatePage.loadPage(template.id, {
+          lockNumber: String(template.lockNumber),
+        });
 
         await submitTemplatePage.clickSubmitTemplateButton();
 
@@ -263,11 +270,12 @@ test.describe('Submit template Page', () => {
         baseURL,
         page,
       }) => {
+        const template = templates[channelIdentifier].empty;
         const submitTemplatePage = new PageModel(page);
 
-        await submitTemplatePage.loadPage(
-          templates[channelIdentifier].empty.id
-        );
+        await submitTemplatePage.loadPage(template.id, {
+          lockNumber: String(template.lockNumber),
+        });
 
         await expect(page).toHaveURL(`${baseURL}/templates/invalid-template`);
       });
@@ -278,10 +286,27 @@ test.describe('Submit template Page', () => {
       }) => {
         const submitTemplatePage = new PageModel(page);
 
-        await submitTemplatePage.loadPage('/fake-template-id');
+        await submitTemplatePage.loadPage('/fake-template-id', {
+          lockNumber: '1',
+        });
 
         await expect(page).toHaveURL(`${baseURL}/templates/invalid-template`);
       });
+
+      test(`when user visits ${channelName} page without a lock number, redirect to the preview page`, async ({
+        baseURL,
+        page,
+      }) => {
+        const template = templates[channelIdentifier].valid;
+
+        const submitTemplatePage = new PageModel(page);
+
+        await submitTemplatePage.loadPage(template.id);
+
+        await expect(page).toHaveURL(
+          `${baseURL}/templates/preview-${channelIdentifier}-template/${template.id}`
+        );
+      });
     });
   }
 });
diff --git a/tests/test-team/template-mgmt-routing-component-tests/choose-templates.routing-component.spec.ts b/tests/test-team/template-mgmt-routing-component-tests/choose-templates.routing-component.spec.ts
index 3cb590664..1ccb10327 100644
--- a/tests/test-team/template-mgmt-routing-component-tests/choose-templates.routing-component.spec.ts
+++ b/tests/test-team/template-mgmt-routing-component-tests/choose-templates.routing-component.spec.ts
@@ -121,10 +121,10 @@ test.describe('Routing - Choose Templates page', () => {
       test(`shows correct channels for message order: ${label}`, async ({
         page,
       }) => {
-        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+        await createMessagePlanPage.loadPage({
           messageOrder,
         });
-        await createMessagePlanPage.loadPage();
         await createMessagePlanPage.nameField.fill(`Plan for ${label}`);
         await createMessagePlanPage.clickSubmit();
 
@@ -251,11 +251,11 @@ test.describe('Routing - Choose Templates page', () => {
   }) => {
     const messageOrder: MessageOrder = 'NHSAPP,SMS';
 
-    const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+    const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+    await createMessagePlanPage.loadPage({
       messageOrder,
     });
-
-    await createMessagePlanPage.loadPage();
     await createMessagePlanPage.nameField.fill('Test message plan');
     await createMessagePlanPage.clickSubmit();
 
diff --git a/tests/test-team/template-mgmt-routing-component-tests/create-message-plan.routing-component.spec.ts b/tests/test-team/template-mgmt-routing-component-tests/create-message-plan.routing-component.spec.ts
index 783ca1210..8e3dcc041 100644
--- a/tests/test-team/template-mgmt-routing-component-tests/create-message-plan.routing-component.spec.ts
+++ b/tests/test-team/template-mgmt-routing-component-tests/create-message-plan.routing-component.spec.ts
@@ -46,12 +46,12 @@ test.describe('Create Message Plan Page', () => {
       test('creates a message plan and redirects to the template selection page for the created message plan', async ({
         page,
       }) => {
-        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+        await createMessagePlanPage.loadPage({
           messageOrder,
         });
 
-        await createMessagePlanPage.loadPage();
-
         await createMessagePlanPage.nameField.fill('My Message Plan');
 
         await expect(createMessagePlanPage.singleCampaignIdElement).toHaveText(
@@ -73,12 +73,12 @@ test.describe('Create Message Plan Page', () => {
       });
 
       test('displays error if name is empty', async ({ page }) => {
-        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+        await createMessagePlanPage.loadPage({
           messageOrder,
         });
 
-        await createMessagePlanPage.loadPage();
-
         await createMessagePlanPage.clickSubmit();
 
         await expect(createMessagePlanPage.nameFieldError).toHaveText(
@@ -87,12 +87,12 @@ test.describe('Create Message Plan Page', () => {
       });
 
       test('displays error if name is too long', async ({ page }) => {
-        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+        await createMessagePlanPage.loadPage({
           messageOrder,
         });
 
-        await createMessagePlanPage.loadPage();
-
         await createMessagePlanPage.nameField.fill('x'.repeat(201));
 
         await createMessagePlanPage.clickSubmit();
@@ -114,12 +114,12 @@ test.describe('Create Message Plan Page', () => {
     test('creates a message plan and redirects to the template selection page for the created template', async ({
       page,
     }) => {
-      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+      await createMessagePlanPage.loadPage({
         messageOrder: 'NHSAPP',
       });
 
-      await createMessagePlanPage.loadPage();
-
       await createMessagePlanPage.nameField.fill('My Message Plan');
 
       await expect(createMessagePlanPage.singleCampaignIdElement).toHaveCount(
@@ -143,12 +143,12 @@ test.describe('Create Message Plan Page', () => {
     });
 
     test('displays error if campaign id is not selected', async ({ page }) => {
-      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+      await createMessagePlanPage.loadPage({
         messageOrder: 'NHSAPP',
       });
 
-      await createMessagePlanPage.loadPage();
-
       await createMessagePlanPage.nameField.fill('My Message Plan');
 
       await createMessagePlanPage.clickSubmit();
@@ -167,12 +167,12 @@ test.describe('Create Message Plan Page', () => {
     });
 
     test('redirects to invalid config page', async ({ baseURL, page }) => {
-      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+      await createMessagePlanPage.loadPage({
         messageOrder: 'NHSAPP',
       });
 
-      await createMessagePlanPage.loadPage();
-
       await expect(page).toHaveURL(
         `${baseURL}/templates/message-plans/campaign-id-required`
       );
@@ -182,11 +182,13 @@ test.describe('Create Message Plan Page', () => {
   for (const { messageOrder } of ROUTING_CONFIG_MESSAGE_ORDER_OPTION_MAPPINGS)
     test.describe(`with the messageOrder query parameter set to ${messageOrder}`, () => {
       test('common page tests', async ({ page, baseURL }) => {
-        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+        const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+        const search = {
           messageOrder,
-        });
+        };
 
-        await createMessagePlanPage.loadPage();
+        await createMessagePlanPage.loadPage(search);
 
         await expect(page).toHaveURL(
           `${baseURL}/templates/message-plans/create-message-plan?messageOrder=${encodeURIComponent(messageOrder)}`
@@ -198,6 +200,7 @@ test.describe('Create Message Plan Page', () => {
         const props = {
           page: createMessagePlanPage,
           id: '',
+          search,
           baseURL,
           expectedUrl: 'templates/message-plans/choose-message-order',
         };
@@ -224,12 +227,12 @@ test.describe('Create Message Plan Page', () => {
 
   test.describe('with invalid messageOrder query parameter set', () => {
     test('redirects to message order page', async ({ page, baseURL }) => {
-      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page, {
+      const createMessagePlanPage = new RoutingCreateMessagePlanPage(page);
+
+      await createMessagePlanPage.loadPage({
         messageOrder: 'INVALID',
       });
 
-      await createMessagePlanPage.loadPage();
-
       await expect(page).toHaveURL(
         `${baseURL}/templates/message-plans/choose-message-order`
       );

From df1b8ec8db67e02188f4a61ef559b86987537d19 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Wed, 19 Nov 2025 19:12:45 +0000
Subject: [PATCH 03/11] CCM-12744: types

---
 lambdas/backend-client/src/types/generated/types.gen.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lambdas/backend-client/src/types/generated/types.gen.ts b/lambdas/backend-client/src/types/generated/types.gen.ts
index 16c02aaa4..b2a9fe2e1 100644
--- a/lambdas/backend-client/src/types/generated/types.gen.ts
+++ b/lambdas/backend-client/src/types/generated/types.gen.ts
@@ -224,6 +224,8 @@ export type SmsProperties = {
 export type TemplateDto = BaseCreatedTemplate &
   (SmsProperties | EmailProperties | NhsAppProperties | LetterProperties);
 
+export type TemplateStatus = TemplateStatusActive | 'DELETED';
+
 export type TemplateStatusActive =
   | 'NOT_YET_SUBMITTED'
   | 'PENDING_PROOF_REQUEST'
@@ -235,8 +237,6 @@ export type TemplateStatusActive =
   | 'WAITING_FOR_PROOF'
   | 'PROOF_AVAILABLE';
 
-export type TemplateStatus = TemplateStatusActive | 'DELETED';
-
 export type TemplateSuccess = {
   data: TemplateDto;
   statusCode: number;

From f979a70a64dda144a797dcb50d21831c7024833c Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 20 Nov 2025 09:03:01 +0000
Subject: [PATCH 04/11] CCM-12744: fixes

---
 .../src/routing-config-api-client.ts          | 19 ++++---------------
 .../pages/template-mgmt-base-page.ts          |  2 +-
 .../routing.accessibility.spec.ts             | 19 +++++++++++++++----
 .../template-mgmt-letter-full.e2e.spec.ts     |  2 ++
 .../routing-config.event.spec.ts              |  7 ++++---
 5 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/lambdas/backend-client/src/routing-config-api-client.ts b/lambdas/backend-client/src/routing-config-api-client.ts
index c4b987401..e0b246daf 100644
--- a/lambdas/backend-client/src/routing-config-api-client.ts
+++ b/lambdas/backend-client/src/routing-config-api-client.ts
@@ -132,21 +132,10 @@ export const routingConfigurationApiClient = {
     routingConfig: UpdateRoutingConfig,
     lockNumber: number
   ): Promise<Result<RoutingConfig>> {
-    if (!uuidSchema.safeParse(id).success) {
-      return {
-        error: {
-          errorMeta: {
-            code: ErrorCase.VALIDATION_FAILED,
-            description: 'Invalid routing configuration ID format',
-            details: { id },
-          },
-          actualError: undefined,
-        },
-      };
-    }
-    const url = `/v1/routing-configuration/${id}` satisfies OpenApiToTemplate<
-      PatchV1RoutingConfigurationByRoutingConfigIdData['url']
-    >;
+    const url =
+      `/v1/routing-configuration/${encodeURIComponent(id)}` satisfies OpenApiToTemplate<
+        PatchV1RoutingConfigurationByRoutingConfigIdData['url']
+      >;
 
     const { data, error } = await catchAxiosError(
       httpClient.patch<RoutingConfigSuccess>(url, routingConfig, {
diff --git a/tests/test-team/pages/template-mgmt-base-page.ts b/tests/test-team/pages/template-mgmt-base-page.ts
index 904107e37..01e76c29d 100644
--- a/tests/test-team/pages/template-mgmt-base-page.ts
+++ b/tests/test-team/pages/template-mgmt-base-page.ts
@@ -205,7 +205,7 @@ export abstract class TemplateMgmtBasePage {
       : this.pathTemplate;
 
     const regexPattern = normalizedPathTemplate.replaceAll(
-      /:([A-Za-z][\dA-z]*)/g,
+      /:([A-Za-z][\dA-Za-z]*)/g,
       '([^/]+)'
     );
 
diff --git a/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts b/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
index 51c97cba5..528785f31 100644
--- a/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
+++ b/tests/test-team/template-mgmt-accessibility/routing.accessibility.spec.ts
@@ -113,11 +113,22 @@ test.describe('Routing - Accessibility', () => {
     });
 
     test('Create message plan', async ({ page, analyze }) =>
-      analyze(new RoutingCreateMessagePlanPage(page)));
+      analyze(
+        new RoutingCreateMessagePlanPage(page).setSearchParam(
+          'messageOrder',
+          messageOrder
+        )
+      ));
 
     test('Create message plan - error', async ({ page, analyze }) =>
-      analyze(new RoutingCreateMessagePlanPage(page), {
-        beforeAnalyze: (p) => p.clickSubmit(),
-      }));
+      analyze(
+        new RoutingCreateMessagePlanPage(page).setSearchParam(
+          'messageOrder',
+          messageOrder
+        ),
+        {
+          beforeAnalyze: (p) => p.clickSubmit(),
+        }
+      ));
   });
 });
diff --git a/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-full.e2e.spec.ts b/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-full.e2e.spec.ts
index d8334ded7..e300228e1 100644
--- a/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-full.e2e.spec.ts
+++ b/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-full.e2e.spec.ts
@@ -237,6 +237,8 @@ function requestProof(
         expect(entry, JSON.stringify(pdfHrefs[i])).not.toBeNull();
       }
 
+      await page.reload();
+
       await previewTemplatePage.clickContinueButton();
     }).toPass({ timeout: 60_000 });
 
diff --git a/tests/test-team/template-mgmt-event-tests/routing-config.event.spec.ts b/tests/test-team/template-mgmt-event-tests/routing-config.event.spec.ts
index 5486875db..7c4bf0186 100644
--- a/tests/test-team/template-mgmt-event-tests/routing-config.event.spec.ts
+++ b/tests/test-team/template-mgmt-event-tests/routing-config.event.spec.ts
@@ -28,17 +28,18 @@ test.describe('Event publishing - Routing Config', () => {
   test('Expect no events', async ({ request }) => {
     const id = randomUUID();
 
+    const messagePlan = RoutingConfigFactory.create(user, { id }).dbEntry;
+
     const start = new Date();
 
-    await storageHelper.seed([
-      RoutingConfigFactory.create(user, { id }).dbEntry,
-    ]);
+    await storageHelper.seed([messagePlan]);
 
     const submittedResponse = await request.patch(
       `${process.env.API_BASE_URL}/v1/routing-configuration/${id}/submit`,
       {
         headers: {
           Authorization: await user.getAccessToken(),
+          'X-Lock-Number': String(messagePlan.lockNumber),
         },
       }
     );

From 58fdaf0d2fdf54efa1dc892170818fa8723e61e5 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 20 Nov 2025 11:12:12 +0000
Subject: [PATCH 05/11] CCM-12744: tests

---
 .../routing-config-api-client.test.ts         | 45 -------------------
 .../src/routing-config-api-client.ts          | 24 ++--------
 2 files changed, 4 insertions(+), 65 deletions(-)

diff --git a/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts b/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
index 2d9305111..0c586d464 100644
--- a/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
+++ b/lambdas/backend-client/src/__tests__/routing-config-api-client.test.ts
@@ -4,11 +4,9 @@ import {
   httpClient,
 } from '../routing-config-api-client';
 import { RoutingConfig, RoutingConfigStatus } from '../types/generated';
-import { ErrorCase } from '../types/error-cases';
 
 const validRoutingConfigId = '2a4b6c8d-0e1f-4a2b-9c3d-5e6f7a8b9c0d';
 const notFoundRoutingConfigId = '3b5d7f9a-1c2e-4b3d-8f0a-6e7d8c9b0a1f';
-const invalidRoutingConfigId = 'not-a-uuid';
 
 describe('RoutingConfigurationApiClient', () => {
   const axiosMock = new MockAdapter(httpClient);
@@ -141,21 +139,6 @@ describe('RoutingConfigurationApiClient', () => {
       expect(axiosMock.history.get.length).toBe(1);
     });
 
-    it('should return error for invalid routing config ID', async () => {
-      const response = await client.get('mock-token', invalidRoutingConfigId);
-
-      expect(response.error).toEqual({
-        errorMeta: {
-          code: ErrorCase.VALIDATION_FAILED,
-          description: 'Invalid routing configuration ID format',
-          details: { id: invalidRoutingConfigId },
-        },
-        actualError: undefined,
-      });
-      expect(response.data).toBeUndefined();
-      expect(axiosMock.history.get.length).toBe(0);
-    });
-
     it('should return routing configuration on success', async () => {
       const data = {
         id: validRoutingConfigId,
@@ -294,34 +277,6 @@ describe('RoutingConfigurationApiClient', () => {
       expect(axiosMock.history.patch.length).toBe(1);
     });
 
-    it('should return error for invalid routing config ID', async () => {
-      const body = {
-        id: invalidRoutingConfigId,
-        name: 'Test plan',
-        campaignId: 'campaign-1',
-        cascade: [],
-        cascadeGroupOverrides: [],
-      };
-
-      const response = await client.update(
-        'mock-token',
-        invalidRoutingConfigId,
-        body,
-        42
-      );
-
-      expect(response.error).toEqual({
-        errorMeta: {
-          code: ErrorCase.VALIDATION_FAILED,
-          description: 'Invalid routing configuration ID format',
-          details: { id: invalidRoutingConfigId },
-        },
-        actualError: undefined,
-      });
-      expect(response.data).toBeUndefined();
-      expect(axiosMock.history.patch.length).toBe(0);
-    });
-
     it('should return updated routing configuration on success', async () => {
       const body = {
         id: validRoutingConfigId,
diff --git a/lambdas/backend-client/src/routing-config-api-client.ts b/lambdas/backend-client/src/routing-config-api-client.ts
index e0b246daf..3dda5f2a9 100644
--- a/lambdas/backend-client/src/routing-config-api-client.ts
+++ b/lambdas/backend-client/src/routing-config-api-client.ts
@@ -11,15 +11,11 @@ import type {
   PatchV1RoutingConfigurationByRoutingConfigIdData,
   UpdateRoutingConfig,
 } from './types/generated';
-import { ErrorCase } from './types/error-cases';
 import { catchAxiosError, createAxiosClient } from './axios-client';
 import { Result } from './types/result';
 import { OpenApiToTemplate } from './types/open-api-helper';
-import { z } from 'zod';
 import { RoutingConfigFilter } from './types/filters';
 
-const uuidSchema = z.uuidv4();
-
 export const httpClient = createAxiosClient();
 
 export const routingConfigurationApiClient = {
@@ -75,22 +71,10 @@ export const routingConfigurationApiClient = {
     token: string,
     id: RoutingConfig['id']
   ): Promise<Result<RoutingConfig>> {
-    if (!uuidSchema.safeParse(id).success) {
-      return {
-        error: {
-          errorMeta: {
-            code: ErrorCase.VALIDATION_FAILED,
-            description: 'Invalid routing configuration ID format',
-            details: { id },
-          },
-          actualError: undefined,
-        },
-      };
-    }
-
-    const url = `/v1/routing-configuration/${id}` satisfies OpenApiToTemplate<
-      GetV1RoutingConfigurationByRoutingConfigIdData['url']
-    >;
+    const url =
+      `/v1/routing-configuration/${encodeURIComponent(id)}` satisfies OpenApiToTemplate<
+        GetV1RoutingConfigurationByRoutingConfigIdData['url']
+      >;
 
     const { data, error } = await catchAxiosError(
       httpClient.get<RoutingConfigSuccess>(url, {

From 38b0469246d7b8002454e4720ee5439574577d75 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 20 Nov 2025 15:20:41 +0000
Subject: [PATCH 06/11] CCM-12744: lock number on digital template pages

---
 .../server-action.test.ts                     |  2 +-
 .../server-action.test.ts                     |  2 +-
 .../PreviewSMSTemplate/server-action.test.ts  |  2 +-
 .../PreviewEmailTemplate/server-actions.ts    |  2 +-
 .../PreviewNHSAppTemplate/server-action.ts    | 30 ++++++++++++-------
 .../PreviewSMSTemplate/server-actions.ts      |  2 +-
 ...-mgmt-preview-email-page.component.spec.ts |  2 +-
 ...gmt-preview-nhs-app-page.component.spec.ts |  2 +-
 ...te-mgmt-preview-sms-page.component.spec.ts |  2 +-
 9 files changed, 27 insertions(+), 19 deletions(-)

diff --git a/frontend/src/__tests__/components/forms/PreviewEmailTemplate/server-action.test.ts b/frontend/src/__tests__/components/forms/PreviewEmailTemplate/server-action.test.ts
index e406d6845..8869a8914 100644
--- a/frontend/src/__tests__/components/forms/PreviewEmailTemplate/server-action.test.ts
+++ b/frontend/src/__tests__/components/forms/PreviewEmailTemplate/server-action.test.ts
@@ -65,7 +65,7 @@ describe('previewEmailTemplateAction server action', () => {
     );
 
     expect(redirectMock).toHaveBeenCalledWith(
-      '/submit-email-template/template-id',
+      '/submit-email-template/template-id?lockNumber=1',
       'push'
     );
   });
diff --git a/frontend/src/__tests__/components/forms/PreviewNHSAppTemplate/server-action.test.ts b/frontend/src/__tests__/components/forms/PreviewNHSAppTemplate/server-action.test.ts
index e91ba230f..d9d2aa8a9 100644
--- a/frontend/src/__tests__/components/forms/PreviewNHSAppTemplate/server-action.test.ts
+++ b/frontend/src/__tests__/components/forms/PreviewNHSAppTemplate/server-action.test.ts
@@ -49,7 +49,7 @@ describe('previewNhsAppTemplateAction', () => {
     previewNhsAppTemplateAction(currentState, formData);
 
     expect(redirectMock).toHaveBeenCalledWith(
-      '/submit-nhs-app-template/template-id',
+      '/submit-nhs-app-template/template-id?lockNumber=1',
       'push'
     );
   });
diff --git a/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts b/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
index 7b9fcd411..6eec07b58 100644
--- a/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
+++ b/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
@@ -64,7 +64,7 @@ describe('previewSmsTemplateAction server action', () => {
     );
 
     expect(redirectMock).toHaveBeenCalledWith(
-      '/submit-text-message-template/template-id',
+      '/submit-text-message-template/template-id?lockNumber=0',
       'push'
     );
   });
diff --git a/frontend/src/components/forms/PreviewEmailTemplate/server-actions.ts b/frontend/src/components/forms/PreviewEmailTemplate/server-actions.ts
index ae17617d4..226b955cf 100644
--- a/frontend/src/components/forms/PreviewEmailTemplate/server-actions.ts
+++ b/frontend/src/components/forms/PreviewEmailTemplate/server-actions.ts
@@ -39,7 +39,7 @@ export async function previewEmailTemplateAction(
 
   if (data.previewEmailTemplateAction === 'email-submit') {
     return redirect(
-      `/submit-email-template/${formState.id}`,
+      `/submit-email-template/${formState.id}?lockNumber=${formState.lockNumber}`,
       RedirectType.push
     );
   }
diff --git a/frontend/src/components/forms/PreviewNHSAppTemplate/server-action.ts b/frontend/src/components/forms/PreviewNHSAppTemplate/server-action.ts
index 42aaa8798..f5a323783 100644
--- a/frontend/src/components/forms/PreviewNHSAppTemplate/server-action.ts
+++ b/frontend/src/components/forms/PreviewNHSAppTemplate/server-action.ts
@@ -12,11 +12,17 @@ const {
   },
 } = content;
 
-const radioSelectionToPageMap: Record<'nhsapp-edit' | 'nhsapp-submit', string> =
-  {
-    'nhsapp-edit': 'edit-nhs-app-template',
-    'nhsapp-submit': 'submit-nhs-app-template',
-  };
+function radioSelectionToRedirectUrl(
+  selection: 'nhsapp-edit' | 'nhsapp-submit',
+  id: string,
+  lockNumber: number
+) {
+  if (selection === 'nhsapp-edit') {
+    return `/edit-nhs-app-template/${id}`;
+  }
+
+  return `/submit-nhs-app-template/${id}?lockNumber=${lockNumber}`;
+}
 
 export const schema = z.object({
   previewNHSAppTemplateAction: z.enum(['nhsapp-edit', 'nhsapp-submit'], {
@@ -38,10 +44,12 @@ export function previewNhsAppTemplateAction(
     };
   }
 
-  const page =
-    radioSelectionToPageMap[
-      validationResponse.data.previewNHSAppTemplateAction
-    ];
-
-  return redirect(`/${page}/${formState.id}`, RedirectType.push);
+  return redirect(
+    radioSelectionToRedirectUrl(
+      validationResponse.data.previewNHSAppTemplateAction,
+      formState.id,
+      formState.lockNumber
+    ),
+    RedirectType.push
+  );
 }
diff --git a/frontend/src/components/forms/PreviewSMSTemplate/server-actions.ts b/frontend/src/components/forms/PreviewSMSTemplate/server-actions.ts
index efb80ed7a..fab071047 100644
--- a/frontend/src/components/forms/PreviewSMSTemplate/server-actions.ts
+++ b/frontend/src/components/forms/PreviewSMSTemplate/server-actions.ts
@@ -42,7 +42,7 @@ export async function previewSmsTemplateAction(
 
   if (data.previewSMSTemplateAction === 'sms-submit') {
     return redirect(
-      `/submit-text-message-template/${formState.id}`,
+      `/submit-text-message-template/${formState.id}?lockNumber=${formState.lockNumber}`,
       RedirectType.push
     );
   }
diff --git a/tests/test-team/template-mgmt-component-tests/email/template-mgmt-preview-email-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/email/template-mgmt-preview-email-page.component.spec.ts
index 9ee30139b..243b11d93 100644
--- a/tests/test-team/template-mgmt-component-tests/email/template-mgmt-preview-email-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/email/template-mgmt-preview-email-page.component.spec.ts
@@ -236,7 +236,7 @@ test.describe('Preview Email message template Page', () => {
         await previewPage.clickContinueButton();
 
         await expect(page).toHaveURL(
-          `${baseURL}/templates/submit-email-template/${templates.routingDisabled.id}`
+          `${baseURL}/templates/submit-email-template/${templates.routingDisabled.id}?lockNumber=${templates.routingDisabled.lockNumber}`
         );
       });
     });
diff --git a/tests/test-team/template-mgmt-component-tests/nhs-app/template-mgmt-preview-nhs-app-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/nhs-app/template-mgmt-preview-nhs-app-page.component.spec.ts
index caddf245a..e4d2c26d3 100644
--- a/tests/test-team/template-mgmt-component-tests/nhs-app/template-mgmt-preview-nhs-app-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/nhs-app/template-mgmt-preview-nhs-app-page.component.spec.ts
@@ -237,7 +237,7 @@ test.describe('Preview NHS App template Page', () => {
         await previewPage.clickContinueButton();
 
         await expect(page).toHaveURL(
-          `${baseURL}/templates/submit-nhs-app-template/${templates.routingDisabled.id}`
+          `${baseURL}/templates/submit-nhs-app-template/${templates.routingDisabled.id}?lockNumber=${templates.routingDisabled.lockNumber}`
         );
       });
     });
diff --git a/tests/test-team/template-mgmt-component-tests/sms/template-mgmt-preview-sms-page.component.spec.ts b/tests/test-team/template-mgmt-component-tests/sms/template-mgmt-preview-sms-page.component.spec.ts
index 2e4c66a32..cf359ce5a 100644
--- a/tests/test-team/template-mgmt-component-tests/sms/template-mgmt-preview-sms-page.component.spec.ts
+++ b/tests/test-team/template-mgmt-component-tests/sms/template-mgmt-preview-sms-page.component.spec.ts
@@ -235,7 +235,7 @@ test.describe('Preview SMS message template Page', () => {
         await previewPage.clickContinueButton();
 
         await expect(page).toHaveURL(
-          `${baseURL}/templates/submit-text-message-template/${templates.routingDisabled.id}`
+          `${baseURL}/templates/submit-text-message-template/${templates.routingDisabled.id}?lockNumber=${templates.routingDisabled.lockNumber}`
         );
       });
     });

From a77676c81cd1166591df049f68a7474778b01389 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 20 Nov 2025 15:44:46 +0000
Subject: [PATCH 07/11] CCM-12744: README

---
 .../forms/PreviewSMSTemplate/server-action.test.ts       | 2 +-
 lambdas/backend-api/README.md                            | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts b/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
index 6eec07b58..df3bbb4a1 100644
--- a/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
+++ b/frontend/src/__tests__/components/forms/PreviewSMSTemplate/server-action.test.ts
@@ -64,7 +64,7 @@ describe('previewSmsTemplateAction server action', () => {
     );
 
     expect(redirectMock).toHaveBeenCalledWith(
-      '/submit-text-message-template/template-id?lockNumber=0',
+      '/submit-text-message-template/template-id?lockNumber=1',
       'push'
     );
   });
diff --git a/lambdas/backend-api/README.md b/lambdas/backend-api/README.md
index b0392eb48..a2a988e96 100644
--- a/lambdas/backend-api/README.md
+++ b/lambdas/backend-api/README.md
@@ -185,13 +185,14 @@ curl -X POST --location "${APIG_STAGE}/v1/routing-configuration" \
 }'
 ```
 
-### PUT - /v1/routing-configuration/:routingConfigId - Update a routing configuration
+### PATCH - /v1/routing-configuration/:routingConfigId - Update a routing configuration
 
 ```bash
-curl -X PUT --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFIG_ID}" \
+curl -X PATCH --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFIG_ID}" \
 --header 'Content-Type: application/json' \
 --header 'Accept: application/json' \
 --header "Authorization: $SANDBOX_TOKEN" \
+--header "X-Lock-Number: $CURRENT_LOCK_NUMBER" \
 --data '{
   "campaignId": "campaign",
   "cascade": [{
@@ -210,7 +211,8 @@ curl -X PUT --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFIG_
 ```bash
 curl -X PATCH --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFIG_ID}/submit" \
 --header 'Accept: application/json' \
---header "Authorization: $SANDBOX_TOKEN"
+--header "Authorization: $SANDBOX_TOKEN" \
+--header "X-Lock-Number: $CURRENT_LOCK_NUMBER"
 ```
 
 ### DELETE - /v1/routing-configuration/:routingConfigId - Delete a routing configuration
@@ -219,6 +221,7 @@ curl -X PATCH --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFI
 curl -X DELETE --location "${APIG_STAGE}/v1/routing-configuration/${ROUTING_CONFIG_ID}" \
 --header 'Accept: application/json' \
 --header "Authorization: $SANDBOX_TOKEN"
+--header "X-Lock-Number: $CURRENT_LOCK_NUMBER"
 ```
 
 <!-- vale on -->

From c4fcd3f8c25e399c065901a24e62813dd6a2ef05 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Fri, 21 Nov 2025 14:32:06 +0000
Subject: [PATCH 08/11] CCM-12744: case-insensitive headers

---
 .../src/__tests__/api/delete-routing-config.test.ts      | 1 +
 lambdas/backend-api/src/__tests__/api/delete.test.ts     | 1 +
 lambdas/backend-api/src/__tests__/api/proof.test.ts      | 1 +
 .../src/__tests__/api/submit-routing-config.test.ts      | 1 +
 lambdas/backend-api/src/__tests__/api/submit.test.ts     | 1 +
 .../src/__tests__/api/update-routing-config.test.ts      | 1 +
 lambdas/backend-api/src/__tests__/api/update.test.ts     | 1 +
 lambdas/backend-api/src/api/delete-routing-config.ts     | 7 ++++---
 lambdas/backend-api/src/api/delete.ts                    | 7 ++++---
 lambdas/backend-api/src/api/proof.ts                     | 7 ++++---
 lambdas/backend-api/src/api/submit-routing-config.ts     | 7 ++++---
 lambdas/backend-api/src/api/submit.ts                    | 9 +++++----
 lambdas/backend-api/src/api/update-routing-config.ts     | 7 ++++---
 lambdas/backend-api/src/api/update.ts                    | 7 ++++---
 .../src/infra/routing-config-repository/repository.ts    | 2 ++
 lambdas/backend-api/src/utils/headers.ts                 | 9 +++++++++
 16 files changed, 47 insertions(+), 22 deletions(-)
 create mode 100644 lambdas/backend-api/src/utils/headers.ts

diff --git a/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
index acc5f2769..3e537c189 100644
--- a/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/delete-routing-config.test.ts
@@ -170,6 +170,7 @@ describe('Delete Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/delete.test.ts b/lambdas/backend-api/src/__tests__/api/delete.test.ts
index 25b3b030d..b65b97b66 100644
--- a/lambdas/backend-api/src/__tests__/api/delete.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/delete.test.ts
@@ -166,6 +166,7 @@ describe('Template API - Delete', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { templateId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/proof.test.ts b/lambdas/backend-api/src/__tests__/api/proof.test.ts
index 5d30bacb5..fb0f5a4de 100644
--- a/lambdas/backend-api/src/__tests__/api/proof.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/proof.test.ts
@@ -123,6 +123,7 @@ describe('Template API - request proof', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { templateId: 'template-id' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
index 729a6e139..4e57baa5b 100644
--- a/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/submit-routing-config.test.ts
@@ -174,6 +174,7 @@ describe('Submit Routing Config Handler', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/submit.test.ts b/lambdas/backend-api/src/__tests__/api/submit.test.ts
index 8dd06fcb3..02aa7b420 100644
--- a/lambdas/backend-api/src/__tests__/api/submit.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/submit.test.ts
@@ -129,6 +129,7 @@ describe('Template API - Submit', () => {
         authorizer: { user: 'sub', clientId: 'nhs-notify-client-id' },
       },
       pathParameters: { templateId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts b/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
index 5dda0bc6b..58b55a303 100644
--- a/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/update-routing-config.test.ts
@@ -258,6 +258,7 @@ describe('Update Routing Config Handler', () => {
       },
       body: JSON.stringify(update),
       pathParameters: { routingConfigId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/__tests__/api/update.test.ts b/lambdas/backend-api/src/__tests__/api/update.test.ts
index 7f6d59cde..d57aadcc1 100644
--- a/lambdas/backend-api/src/__tests__/api/update.test.ts
+++ b/lambdas/backend-api/src/__tests__/api/update.test.ts
@@ -261,6 +261,7 @@ describe('Template API - Update', () => {
       },
       body: JSON.stringify(update),
       pathParameters: { templateId: '1-2-3' },
+      headers: {},
     });
 
     const result = await handler(event, mock<Context>(), jest.fn());
diff --git a/lambdas/backend-api/src/api/delete-routing-config.ts b/lambdas/backend-api/src/api/delete-routing-config.ts
index 3df7508e9..612c7637f 100644
--- a/lambdas/backend-api/src/api/delete-routing-config.ts
+++ b/lambdas/backend-api/src/api/delete-routing-config.ts
@@ -1,7 +1,8 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, noContent } from './responses';
-import type { RoutingConfigClient } from '../app/routing-config-client';
 import { logger } from 'nhs-notify-web-template-management-utils/logger';
+import { apiFailure, noContent } from '@backend-api/api/responses';
+import type { RoutingConfigClient } from '@backend-api/app/routing-config-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   routingConfigClient,
@@ -23,7 +24,7 @@ export function createHandler({
     const { error } = await routingConfigClient.deleteRoutingConfig(
       routingConfigId,
       user,
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/delete.ts b/lambdas/backend-api/src/api/delete.ts
index 67f74e485..e2057bfcf 100644
--- a/lambdas/backend-api/src/api/delete.ts
+++ b/lambdas/backend-api/src/api/delete.ts
@@ -1,6 +1,7 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, noContent } from './responses';
-import { TemplateClient } from '../app/template-client';
+import { apiFailure, noContent } from '@backend-api/api/responses';
+import type { TemplateClient } from '@backend-api/app/template-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   templateClient,
@@ -22,7 +23,7 @@ export function createHandler({
         userId,
         clientId,
       },
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/proof.ts b/lambdas/backend-api/src/api/proof.ts
index b8ee6923f..b635037df 100644
--- a/lambdas/backend-api/src/api/proof.ts
+++ b/lambdas/backend-api/src/api/proof.ts
@@ -1,6 +1,7 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, apiSuccess } from './responses';
-import { TemplateClient } from '../app/template-client';
+import { apiFailure, apiSuccess } from '@backend-api/api/responses';
+import { TemplateClient } from '@backend-api/app/template-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   templateClient,
@@ -22,7 +23,7 @@ export function createHandler({
         userId,
         clientId,
       },
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/submit-routing-config.ts b/lambdas/backend-api/src/api/submit-routing-config.ts
index b28f9875d..710b110e2 100644
--- a/lambdas/backend-api/src/api/submit-routing-config.ts
+++ b/lambdas/backend-api/src/api/submit-routing-config.ts
@@ -1,7 +1,8 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, apiSuccess } from './responses';
-import type { RoutingConfigClient } from '../app/routing-config-client';
 import { logger } from 'nhs-notify-web-template-management-utils/logger';
+import { apiFailure, apiSuccess } from '@backend-api/api/responses';
+import type { RoutingConfigClient } from '@backend-api/app/routing-config-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   routingConfigClient,
@@ -23,7 +24,7 @@ export function createHandler({
     const { data, error } = await routingConfigClient.submitRoutingConfig(
       routingConfigId,
       user,
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/submit.ts b/lambdas/backend-api/src/api/submit.ts
index 0c2318ba9..841f9dc19 100644
--- a/lambdas/backend-api/src/api/submit.ts
+++ b/lambdas/backend-api/src/api/submit.ts
@@ -1,7 +1,8 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, apiSuccess } from './responses';
-import { TemplateClient } from '../app/template-client';
-import { EmailClient } from 'nhs-notify-web-template-management-utils/email-client';
+import type { EmailClient } from 'nhs-notify-web-template-management-utils/email-client';
+import { apiFailure, apiSuccess } from '@backend-api/api/responses';
+import type { TemplateClient } from '@backend-api/app/template-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   templateClient,
@@ -25,7 +26,7 @@ export function createHandler({
         userId,
         clientId,
       },
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/update-routing-config.ts b/lambdas/backend-api/src/api/update-routing-config.ts
index 1c0c173df..515ae1793 100644
--- a/lambdas/backend-api/src/api/update-routing-config.ts
+++ b/lambdas/backend-api/src/api/update-routing-config.ts
@@ -1,7 +1,8 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, apiSuccess } from './responses';
-import { RoutingConfigClient } from '../app/routing-config-client';
 import { logger } from 'nhs-notify-web-template-management-utils/logger';
+import { apiFailure, apiSuccess } from '@backend-api/api/responses';
+import type { RoutingConfigClient } from '@backend-api/app/routing-config-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   routingConfigClient,
@@ -29,7 +30,7 @@ export function createHandler({
       routingConfigId,
       payload,
       { userId, clientId },
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/api/update.ts b/lambdas/backend-api/src/api/update.ts
index 185c4dcab..a7f69e263 100644
--- a/lambdas/backend-api/src/api/update.ts
+++ b/lambdas/backend-api/src/api/update.ts
@@ -1,6 +1,7 @@
 import type { APIGatewayProxyHandler } from 'aws-lambda';
-import { apiFailure, apiSuccess } from './responses';
-import { TemplateClient } from '../app/template-client';
+import { apiFailure, apiSuccess } from '@backend-api/api/responses';
+import type { TemplateClient } from '@backend-api/app/template-client';
+import { toHeaders } from '@backend-api/utils/headers';
 
 export function createHandler({
   templateClient,
@@ -22,7 +23,7 @@ export function createHandler({
       templateId,
       dto,
       { userId, clientId },
-      event.headers['X-Lock-Number'] ?? ''
+      toHeaders(event.headers).get('X-Lock-Number') ?? ''
     );
 
     if (error) {
diff --git a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
index 4bd5b7492..c3523ee03 100644
--- a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
+++ b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
@@ -260,6 +260,8 @@ export class RoutingConfigRepository {
         );
       }
 
+      console.log(item, expectedLockNumber);
+
       if (item.lockNumber !== expectedLockNumber) {
         return failure(
           ErrorCase.CONFLICT,
diff --git a/lambdas/backend-api/src/utils/headers.ts b/lambdas/backend-api/src/utils/headers.ts
new file mode 100644
index 000000000..90a0b1c11
--- /dev/null
+++ b/lambdas/backend-api/src/utils/headers.ts
@@ -0,0 +1,9 @@
+import type { APIGatewayProxyEventHeaders } from 'aws-lambda';
+
+export function toHeaders(headers: APIGatewayProxyEventHeaders): Headers {
+  return new Headers(
+    Object.entries(headers).filter(
+      (entry): entry is [string, string] => entry[1] !== undefined
+    )
+  );
+}

From 67fa75fc6c5b8e6d6dd40e96d59ad1573ec53cbe Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Fri, 21 Nov 2025 15:22:28 +0000
Subject: [PATCH 09/11] CCM-12744: remove stray log

---
 .../src/infra/routing-config-repository/repository.ts           | 2 --
 1 file changed, 2 deletions(-)

diff --git a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
index c3523ee03..4bd5b7492 100644
--- a/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
+++ b/lambdas/backend-api/src/infra/routing-config-repository/repository.ts
@@ -260,8 +260,6 @@ export class RoutingConfigRepository {
         );
       }
 
-      console.log(item, expectedLockNumber);
-
       if (item.lockNumber !== expectedLockNumber) {
         return failure(
           ErrorCase.CONFLICT,

From a45873080a5474dd5a0fa33637ad54d0d6127a60 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 27 Nov 2025 11:57:22 +0000
Subject: [PATCH 10/11] CCM-12744: feedback

---
 .../server-action.test.ts                     | 43 ++++++++++---------
 .../ChooseChannelTemplate/server-action.ts    |  2 +-
 .../repository.test.ts                        | 36 ++++++++--------
 .../update-routing-config.api.spec.ts         | 10 ++---
 .../routing-config-update-builder.test.ts     |  5 +--
 .../src/routing-config-update-builder.ts      |  6 +--
 6 files changed, 49 insertions(+), 53 deletions(-)

diff --git a/frontend/src/__tests__/components/forms/ChooseChannelTemplate/server-action.test.ts b/frontend/src/__tests__/components/forms/ChooseChannelTemplate/server-action.test.ts
index e3ed6737b..f1d495cd1 100644
--- a/frontend/src/__tests__/components/forms/ChooseChannelTemplate/server-action.test.ts
+++ b/frontend/src/__tests__/components/forms/ChooseChannelTemplate/server-action.test.ts
@@ -21,6 +21,7 @@ test('submit form - validation error', async () => {
       messagePlan: ROUTING_CONFIG,
       pageHeading: 'Choose an NHS App template',
       cascadeIndex: 0,
+      templateList: [NHS_APP_TEMPLATE],
     },
     getMockFormData({})
   );
@@ -38,9 +39,6 @@ test('submit form - validation error', async () => {
 });
 
 test('submit form - success updates config and redirects to choose templates', async () => {
-  const mockRedirect = jest.mocked(redirect);
-  const mockUpdateRoutingConfig = jest.mocked(updateRoutingConfig);
-
   await chooseChannelTemplateAction(
     {
       messagePlan: {
@@ -68,6 +66,7 @@ test('submit form - success updates config and redirects to choose templates', a
       },
       pageHeading: 'Choose an email template',
       cascadeIndex: 1,
+      templateList: [EMAIL_TEMPLATE],
     },
     getMockFormData({
       channelTemplate: EMAIL_TEMPLATE.id,
@@ -75,7 +74,7 @@ test('submit form - success updates config and redirects to choose templates', a
     })
   );
 
-  expect(mockUpdateRoutingConfig).toHaveBeenCalledWith(
+  expect(updateRoutingConfig).toHaveBeenCalledWith(
     ROUTING_CONFIG.id,
     {
       cascade: [
@@ -103,16 +102,13 @@ test('submit form - success updates config and redirects to choose templates', a
     EMAIL_TEMPLATE.lockNumber
   );
 
-  expect(mockRedirect).toHaveBeenCalledWith(
+  expect(redirect).toHaveBeenCalledWith(
     `/message-plans/choose-templates/${ROUTING_CONFIG.id}`,
     RedirectType.push
   );
 });
 
 test('submit form - success updates config and redirects to choose templates for letter template with supplier references', async () => {
-  const mockRedirect = jest.mocked(redirect);
-  const mockUpdateRoutingConfig = jest.mocked(updateRoutingConfig);
-
   await chooseChannelTemplateAction(
     {
       messagePlan: {
@@ -139,23 +135,28 @@ test('submit form - success updates config and redirects to choose templates for
     },
     getMockFormData({
       channelTemplate: LETTER_TEMPLATE.id,
+      lockNumber: String(LETTER_TEMPLATE.lockNumber),
     })
   );
 
-  expect(mockUpdateRoutingConfig).toHaveBeenCalledWith(ROUTING_CONFIG.id, {
-    cascade: [
-      {
-        cascadeGroups: ['standard'],
-        channel: 'LETTER',
-        channelType: 'primary',
-        defaultTemplateId: LETTER_TEMPLATE.id,
-        supplierReferences: { MBA: 'mba-supplier-reference' },
-      },
-    ],
-    cascadeGroupOverrides: [],
-  });
+  expect(updateRoutingConfig).toHaveBeenCalledWith(
+    ROUTING_CONFIG.id,
+    {
+      cascade: [
+        {
+          cascadeGroups: ['standard'],
+          channel: 'LETTER',
+          channelType: 'primary',
+          defaultTemplateId: LETTER_TEMPLATE.id,
+          supplierReferences: { MBA: 'mba-supplier-reference' },
+        },
+      ],
+      cascadeGroupOverrides: [],
+    },
+    LETTER_TEMPLATE.lockNumber
+  );
 
-  expect(mockRedirect).toHaveBeenCalledWith(
+  expect(redirect).toHaveBeenCalledWith(
     `/message-plans/choose-templates/${ROUTING_CONFIG.id}`,
     RedirectType.push
   );
diff --git a/frontend/src/components/forms/ChooseChannelTemplate/server-action.ts b/frontend/src/components/forms/ChooseChannelTemplate/server-action.ts
index b9fa3dd69..8a5303407 100644
--- a/frontend/src/components/forms/ChooseChannelTemplate/server-action.ts
+++ b/frontend/src/components/forms/ChooseChannelTemplate/server-action.ts
@@ -8,7 +8,7 @@ import { $LockNumber } from 'nhs-notify-backend-client';
 export type ChooseChannelTemplateFormState = FormState &
   Pick<
     ChooseChannelTemplateProps,
-    'cascadeIndex' | 'messagePlan' | 'pageHeading'
+    'cascadeIndex' | 'messagePlan' | 'pageHeading' | 'templateList'
   >;
 
 export const $ChooseChannelTemplate = (errorMessage: string) =>
diff --git a/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts b/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
index bf1493989..f16f411ab 100644
--- a/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
+++ b/lambdas/backend-api/src/__tests__/infra/routing-config-repository/repository.test.ts
@@ -247,7 +247,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#status': 'status',
           '#updatedAt': 'updatedAt',
@@ -256,7 +256,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':status': 'COMPLETED',
           ':updatedAt': date.toISOString(),
@@ -441,7 +441,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#lockNumber': 'lockNumber',
           '#status': 'status',
@@ -451,7 +451,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':status': 'DELETED',
           ':updatedAt': date.toISOString(),
@@ -644,7 +644,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#campaignId': 'campaignId',
           '#cascade': 'cascade',
@@ -660,7 +660,7 @@ describe('RoutingConfigRepository', () => {
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
@@ -697,7 +697,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#lockNumber': 'lockNumber',
           '#name': 'name',
@@ -707,7 +707,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
@@ -744,7 +744,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#lockNumber': 'lockNumber',
           '#campaignId': 'campaignId',
@@ -754,7 +754,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':campaignId': update.campaignId,
           ':updatedAt': date.toISOString(),
@@ -799,7 +799,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#cascade': 'cascade',
           '#cascadeGroupOverrides': 'cascadeGroupOverrides',
@@ -810,7 +810,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
@@ -856,7 +856,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#lockNumber': 'lockNumber',
           '#name': 'name',
@@ -866,7 +866,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
@@ -904,7 +904,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#lockNumber': 'lockNumber',
           '#name': 'name',
@@ -914,7 +914,7 @@ describe('RoutingConfigRepository', () => {
         },
         ExpressionAttributeValues: {
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
@@ -950,7 +950,7 @@ describe('RoutingConfigRepository', () => {
 
       expect(mocks.dynamo).toHaveReceivedCommandWith(UpdateCommand, {
         ConditionExpression:
-          '#status = :condition_1_status AND (#lockNumber = :condition_2_1_lockNumber OR attribute_not_exists (#lockNumber))',
+          '#status = :condition_1_status AND #lockNumber = :condition_2_lockNumber',
         ExpressionAttributeNames: {
           '#campaignId': 'campaignId',
           '#cascade': 'cascade',
@@ -966,7 +966,7 @@ describe('RoutingConfigRepository', () => {
           ':cascade': update.cascade,
           ':cascadeGroupOverrides': update.cascadeGroupOverrides,
           ':condition_1_status': 'DRAFT',
-          ':condition_2_1_lockNumber': 2,
+          ':condition_2_lockNumber': 2,
           ':lockNumber': 1,
           ':name': update.name,
           ':updatedAt': date.toISOString(),
diff --git a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
index f040fc023..f1a994892 100644
--- a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
@@ -411,7 +411,7 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
       const start = new Date();
 
       const updateResponse = await request.put(
-        `${process.env.API_BASE_URL}/v1/routing-configuration/${routingConfig.dbEntry.id}`,
+        `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
@@ -427,7 +427,7 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
       expect(updated).toEqual({
         statusCode: 200,
         data: {
-          ...routingConfig.apiResponse,
+          ...apiResponse,
           ...update,
           updatedAt: expect.stringMatching(isoDateRegExp),
         },
@@ -437,13 +437,13 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
         start,
         new Date(),
       ]);
-      expect(updated.data.createdAt).toEqual(routingConfig.dbEntry.createdAt);
+      expect(updated.data.createdAt).toEqual(dbEntry.createdAt);
     });
 
     test('cascade and cascadeGroupOverrides with supplierReferences - returns 200 and the updated routing config data', async ({
       request,
     }) => {
-      const routingConfig = RoutingConfigFactory.create(user1, {
+      const { dbEntry, apiResponse } = RoutingConfigFactory.create(user1, {
         cascade: [
           {
             cascadeGroups: ['standard'],
@@ -457,7 +457,7 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
         ],
       });
 
-      await storageHelper.seed([routingConfig.dbEntry]);
+      await storageHelper.seed([dbEntry]);
 
       const update = {
         cascade: [
diff --git a/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts b/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
index 5390c408f..d449ae6f3 100644
--- a/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
+++ b/utils/entity-update-command-builder/src/__tests__/routing-config-update-builder.test.ts
@@ -349,11 +349,10 @@ describe('RoutingConfigUpdateBuilder', () => {
           '#status': 'status',
         },
         ExpressionAttributeValues: {
-          ':condition_1_1_lockNumber': 5,
+          ':condition_1_lockNumber': 5,
           ':status': 'COMPLETED',
         },
-        ConditionExpression:
-          '(#lockNumber = :condition_1_1_lockNumber OR attribute_not_exists (#lockNumber))',
+        ConditionExpression: '#lockNumber = :condition_1_lockNumber',
         Key: {
           id: mockId,
           owner: mockOwnerKey,
diff --git a/utils/entity-update-command-builder/src/routing-config-update-builder.ts b/utils/entity-update-command-builder/src/routing-config-update-builder.ts
index ebb366a28..2eb947dc5 100644
--- a/utils/entity-update-command-builder/src/routing-config-update-builder.ts
+++ b/utils/entity-update-command-builder/src/routing-config-update-builder.ts
@@ -80,11 +80,7 @@ export class RoutingConfigUpdateBuilder extends EntityUpdateBuilder<
   }
 
   expectLockNumber(lockNumber: number) {
-    this.updateBuilder.conditions.andGroup((group) => {
-      group
-        .and('lockNumber', '=', lockNumber)
-        .orFn('attribute_not_exists', 'lockNumber');
-    });
+    this.updateBuilder.conditions.and('lockNumber', '=', lockNumber);
 
     return this;
   }

From dbc09ab04c4ba8b3f8f0447755e8430ec1391899 Mon Sep 17 00:00:00 2001
From: Michael Harrison <michael.harrison31@nhs.net>
Date: Thu, 27 Nov 2025 12:39:51 +0000
Subject: [PATCH 11/11] CCM-12744: fix api test

---
 .../template-mgmt-api-tests/update-routing-config.api.spec.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
index f1a994892..c51dc589e 100644
--- a/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
+++ b/tests/test-team/template-mgmt-api-tests/update-routing-config.api.spec.ts
@@ -410,11 +410,12 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
 
       const start = new Date();
 
-      const updateResponse = await request.put(
+      const updateResponse = await request.patch(
         `${process.env.API_BASE_URL}/v1/routing-configuration/${dbEntry.id}`,
         {
           headers: {
             Authorization: await user1.getAccessToken(),
+            'X-Lock-Number': String(dbEntry.lockNumber),
           },
           data: update,
         }
@@ -430,6 +431,7 @@ test.describe('PATCH /v1/routing-configuration/:routingConfigId', () => {
           ...apiResponse,
           ...update,
           updatedAt: expect.stringMatching(isoDateRegExp),
+          lockNumber: dbEntry.lockNumber + 1,
         },
       });