diff --git a/.github/workflows/cloudflare-main.yml b/.github/workflows/cloudflare-main.yml
index f375242..5b6aa5e 100644
--- a/.github/workflows/cloudflare-main.yml
+++ b/.github/workflows/cloudflare-main.yml
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -76,7 +76,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       # Under single topology the candidate and the release are the same
       # Worker, so deploying here would serve the merge immediately and there
@@ -98,7 +98,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       operation: preview
       target: release
@@ -184,7 +184,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/cloudflare-pr.yml b/.github/workflows/cloudflare-pr.yml
index 4ffebd7..07d443b 100644
--- a/.github/workflows/cloudflare-pr.yml
+++ b/.github/workflows/cloudflare-pr.yml
@@ -31,7 +31,7 @@ jobs:
       github.event_name != 'pull_request' ||
       (github.event.pull_request.draft == false &&
        github.event.pull_request.head.repo.full_name == github.repository)
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -62,7 +62,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       operation: preview
       target: candidate
diff --git a/.github/workflows/cloudflare-release.yml b/.github/workflows/cloudflare-release.yml
index 2a6bbe1..e097bcd 100644
--- a/.github/workflows/cloudflare-release.yml
+++ b/.github/workflows/cloudflare-release.yml
@@ -56,7 +56,7 @@ jobs:
 
   quality:
     needs: validate
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
       deployment-policy-path: ${{ inputs.deployment-policy-path }}
@@ -89,7 +89,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       operation: preview
       target: release
@@ -108,7 +108,7 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/cloudflare-version.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       operation: deploy
       target: release
diff --git a/.github/workflows/npm-changesets.yml b/.github/workflows/npm-changesets.yml
index 7709824..2570b63 100644
--- a/.github/workflows/npm-changesets.yml
+++ b/.github/workflows/npm-changesets.yml
@@ -96,7 +96,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy-path: ${{ inputs.quality-policy-path }}
 
@@ -236,7 +236,7 @@ jobs:
           fi
       - name: Create release pull request or publish to npm
         if: steps.freshness.outputs.stale == 'false'
-        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        uses: changesets/action@8488615a623b1b9c987934bb89eae8af6a946ac1 # v2.1.1
         with:
           title: ${{ inputs.pr-title }}
           commit: ${{ inputs.pr-commit }}
diff --git a/.github/workflows/npm-main.yml b/.github/workflows/npm-main.yml
index a002eb6..112afe5 100644
--- a/.github/workflows/npm-main.yml
+++ b/.github/workflows/npm-main.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
 
   metadata:
     needs: quality
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
@@ -171,7 +171,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/npm-pr.yml b/.github/workflows/npm-pr.yml
index 948248f..223435f 100644
--- a/.github/workflows/npm-pr.yml
+++ b/.github/workflows/npm-pr.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
 
   pack:
     name: Package dry run
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index 53eaa42..ffc104b 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   quality:
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
 
   metadata:
     needs: quality
@@ -52,7 +52,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/npm-publish.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
     with:
       quality-policy: ${{ needs.quality.outputs.quality-policy }}
       npm-policy: ${{ needs.quality.outputs.npm-policy }}
diff --git a/.github/workflows/phala-deploy.yml b/.github/workflows/phala-deploy.yml
index b86eb25..3ac821e 100644
--- a/.github/workflows/phala-deploy.yml
+++ b/.github/workflows/phala-deploy.yml
@@ -47,7 +47,7 @@ jobs:
 
   quality:
     needs: policy
-    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@ffc9220f81438c2537163f041f117d3097738fed # v1.4.1
+    uses: burnt-labs/github-workflows/.github/workflows/required-quality.yml@e80433becb3bfbd429ade0815c8e012912190205 # v1.4.1
 
   deploy:
     name: Phala ${{ inputs.target }}
@@ -137,7 +137,7 @@ jobs:
               ;;
           esac
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Login to GHCR for push
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with: