diff --git a/.github/file-sync/node-sync.yml b/.github/file-sync/node-sync.yml
index 961833d87..fcb48d5b0 100644
--- a/.github/file-sync/node-sync.yml
+++ b/.github/file-sync/node-sync.yml
@@ -4,7 +4,7 @@ version: 1
 source:
   repository: webitel/reusable-configs
   config: node/sync.yml
-  sha: ef4e42032ca6d3cd02a819e6978ed645e2e227b3
+  sha: 2e99e2f2f50917905951522fbad9ab2b690dd8d7
 files:
   .github/dependabot.yml:
     source: node/configs/dependabot.yml
@@ -18,15 +18,15 @@ files:
   .github/workflows/cleanup-artifacts.yml:
     source: common/workflows/cleanup-artifacts.yml.njk
     sha256: c23ab5c2fec1713ce637e0c697b94aee74e41c408411dd3413ff8297b8c58d2b
+  .github/workflows/codeql-scheduled.yml:
+    source: common/workflows/codeql-scheduled.yml.njk
+    sha256: 66fd57a96ec467214ae29ed6a1f5bbd0eb1290cc7e127febd56c7e63d263dc69
   .github/workflows/libs.update.yml:
     source: node/workflows/libs.update.yml
     sha256: 3a28a8bd66b5222de3bc41e3e914fb98a76b7a66d0bd93eb7e45da8ccfbb8fce
   .github/workflows/make-release.yml:
     source: node/workflows/make-release.yml
     sha256: 75535b41cb6ec3de455531f8fa5b08b098d57df8b6645c93da52b972884f923e
-  .github/workflows/pull-request-deliver.yml:
-    source: common/workflows/pull-request-deliver.yml.njk
-    sha256: 3b071a3b5d62d5d6ae8cfb201bb1d33b4105c7f877d9e95d92df705e6ae3a149
   .github/workflows/pull-request.yml:
     source: node/workflows/pull-request.yml.njk
     sha256: 3fa92115fe05cf1e80b7bdb2ad91961dfa57bb98c69a708ea18306cd85474185
diff --git a/.github/workflows/codeql-scheduled.yml b/.github/workflows/codeql-scheduled.yml
new file mode 100644
index 000000000..13d875010
--- /dev/null
+++ b/.github/workflows/codeql-scheduled.yml
@@ -0,0 +1,33 @@
+# Code generated by file-sync from webitel/reusable-configs. DO NOT EDIT.
+# Source: common/workflows/codeql-scheduled.yml.njk
+# Edit the source instead; local changes are overwritten on the next sync.
+
+name: CodeQL (scheduled)
+
+on:
+  schedule:
+    - cron: "0 2 * * 1"
+
+  workflow_dispatch:
+    inputs:
+      force:
+        type: boolean
+        default: false
+        description: Analyze even languages analyzed within the last 7 days
+
+permissions: { contents: read }
+
+jobs:
+  codeql:
+    name: CodeQL
+    uses: webitel/reusable-workflows/.github/workflows/codeql-scheduled.yml@v2
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+
+    with:
+      languages: '[{"language":"javascript","build-mode":"none"},{"language":"actions","build-mode":"none"}]'
+      analysis-key: .github/workflows/node-checks.yml:analyze
+      runs-on: arc-frontend-runner-set
+      max-age-days: ${{ fromJSON(inputs.force && '0' || '7') }}
diff --git a/.github/workflows/pull-request-deliver.yml b/.github/workflows/pull-request-deliver.yml
deleted file mode 100644
index 10e0e4710..000000000
--- a/.github/workflows/pull-request-deliver.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-# Code generated by file-sync from webitel/reusable-configs. DO NOT EDIT.
-# Source: common/workflows/pull-request-deliver.yml.njk
-# Edit the source instead; local changes are overwritten on the next sync.
-
-name: PR deliver (webitel-admin-app)
-run-name: "webitel-admin-app@${{ github.event.workflow_run.head_branch }} - upload package for #${{ github.event.workflow_run.run_number }}"
-
-on:
-  workflow_run:
-    workflows: [ "PR (webitel-admin-app)" ]
-    types: [ completed ]
-
-permissions: { contents: read }
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
-  cancel-in-progress: true
-
-jobs:
-  version:
-    name: Version
-    uses: webitel/reusable-workflows/.github/workflows/_version.yml@v2
-    permissions:
-      contents: read
-      id-token: write
-
-    if: |
-      github.event.workflow_run.head_repository.fork == false &&
-      github.event.workflow_run.conclusion == 'success'
-
-    with:
-      versioning: calver
-      development-branch: ${{ github.event.repository.default_branch }}
-      triggered-branch: ${{ github.event.workflow_run.head_branch }}
-      arch: ${{ vars.BUILD_ARCH }}
-      codename: ${{ vars.DEB_CODENAME }}
-
-  publish:
-    name: Publish .deb package (${{ matrix.arch }}/${{ matrix.codename }})
-    needs: [ version ]
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: ${{ fromJSON(needs.version.outputs.arch-matrix) }}
-        codename: ${{ fromJSON(needs.version.outputs.codename-matrix) }}
-
-    uses: webitel/reusable-workflows/.github/workflows/_publish-deb.yml@v2
-    permissions:
-      id-token: write
-      actions: read
-      contents: read
-
-    secrets:
-      DEB_S3_ACCESS_KEY_ID: ${{ secrets.DEB_S3_ACCESS_KEY_ID }}
-      DEB_S3_SECRET_ACCESS_KEY: ${{ secrets.DEB_S3_SECRET_ACCESS_KEY }}
-      REPO_SIGNING_KEY: ${{ secrets.REPO_SIGNING_KEY }}
-      REPO_SIGNING_KEY_PASSPHRASE: ${{ secrets.REPO_SIGNING_KEY_PASSPHRASE }}
-      DELIVERY_BOT_APP_PEM: ${{ secrets.DELIVERY_BOT_APP_PEM }}
-
-    with:
-      arch: ${{ matrix.arch }}
-      deb-package-pattern: "webitel-admin-app*.deb"
-      deb-component: dev
-      deb-codename: ${{ matrix.codename }}
-      deb-s3-bucket-name: ${{ vars.DEB_S3_BUCKET_NAME }}
-      deb-s3-bucket-region: ${{ vars.DEB_S3_DEFAULT_REGION }}
-      deb-s3-endpoint: ${{ vars.DEB_S3_ENDPOINT }}
-      deb-s3-force-path-style: ${{ vars.DEB_S3_FORCE_PATH_STYLE == 'true' }}
-      github-app-client-id: ${{ vars.DELIVERY_BOT_CLIENT_ID }}
-      artifact-repository-owner: ${{ github.repository_owner }}
-      artifact-repository: ${{ github.event.repository.name }}
-      artifact-actions-run-id: ${{ github.event.workflow_run.id }}