diff --git a/.github/file-sync/golang-sync.yml b/.github/file-sync/golang-sync.yml
index 532c5daf..36a98546 100644
--- a/.github/file-sync/golang-sync.yml
+++ b/.github/file-sync/golang-sync.yml
@@ -4,7 +4,7 @@ version: 1
 source:
   repository: webitel/reusable-configs
   config: golang/sync.yml
-  sha: 31637e56b4e04217b50b74362c7ed9ff266119b6
+  sha: f8efdd23859604dc32d765efc993c7118955627e
 files:
   .editorconfig:
     source: golang/configs/.editorconfig
@@ -24,18 +24,21 @@ files:
   .github/workflows/cleanup-artifacts.yml:
     source: common/workflows/cleanup-artifacts.yml.njk
     sha256: c23ab5c2fec1713ce637e0c697b94aee74e41c408411dd3413ff8297b8c58d2b
+  .github/workflows/codeql-scheduled.yml:
+    source: common/workflows/codeql-scheduled.yml.njk
+    sha256: de6d6019bdbb33a6f42de3be76d5c0bfd95565434b9ff49a939250461538e098
   .github/workflows/dependabot-auto-merge.yml:
     source: common/workflows/dependabot-auto-merge.yml
     sha256: 3f9a2526900d4505d509e45ee406c6cccfaaca7e1661f7919863019e74fdcdc2
-  .github/workflows/pull-request-deliver.yml:
-    source: common/workflows/pull-request-deliver.yml.njk
-    sha256: 18d136fb708edf06ded78bd98f2a7a42c873b40f850932f763c2a63bf37cc427
   .github/workflows/pull-request.yml:
     source: golang/workflows/pull-request.yml.njk
     sha256: c06d0eb3ef2e9c87e4f77c4ad4f30e692f2c4897de324befcb241db3b7819bd4
   .github/workflows/release-branch.yml:
     source: common/workflows/release-branch.yml
     sha256: 72dcf66a77e60068d4b98441f1ed44fbb2b9e03879c856544345e14a7ad495d2
+  .github/workflows/vulncheck.yml:
+    source: golang/workflows/vulncheck.yml.njk
+    sha256: 64081c279d210d3901039784068057c46a7b90e4f33e7fcffff941bfaa284ef2
   .github/workflows/workflow.yml:
     source: golang/workflows/workflow.yml.njk
     sha256: 796ad1a4ac613802f550e9e49803c55baadfa7bf504a03ab639634c60d0e4da8
diff --git a/.github/workflows/codeql-scheduled.yml b/.github/workflows/codeql-scheduled.yml
new file mode 100644
index 00000000..8b13dd7d
--- /dev/null
+++ b/.github/workflows/codeql-scheduled.yml
@@ -0,0 +1,33 @@
+# Code generated by file-sync from webitel/reusable-configs. DO NOT EDIT.
+# Source: common/workflows/codeql-scheduled.yml.njk
+# Edit the source instead; local changes are overwritten on the next sync.
+
+name: CodeQL (scheduled)
+
+on:
+  schedule:
+    - cron: "0 2 * * 1"
+
+  workflow_dispatch:
+    inputs:
+      force:
+        type: boolean
+        default: false
+        description: Analyze even languages analyzed within the last 7 days
+
+permissions: { contents: read }
+
+jobs:
+  codeql:
+    name: CodeQL
+    uses: webitel/reusable-workflows/.github/workflows/codeql-scheduled.yml@v2
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+
+    with:
+      languages: '[{"language":"go","build-mode":"autobuild"},{"language":"actions","build-mode":"none"}]'
+      analysis-key: .github/workflows/golang-checks.yml:analyze
+      runs-on: arc-backend-runner-set
+      max-age-days: ${{ fromJSON(inputs.force && '0' || '7') }}
diff --git a/.github/workflows/pull-request-deliver.yml b/.github/workflows/pull-request-deliver.yml
deleted file mode 100644
index 2ac79095..00000000
--- a/.github/workflows/pull-request-deliver.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-# Code generated by file-sync from webitel/reusable-configs. DO NOT EDIT.
-# Source: common/workflows/pull-request-deliver.yml.njk
-# Edit the source instead; local changes are overwritten on the next sync.
-
-name: PR deliver (webitel-flow-manager)
-run-name: "webitel-flow-manager@${{ github.event.workflow_run.head_branch }} - upload package for #${{ github.event.workflow_run.run_number }}"
-
-on:
-  workflow_run:
-    workflows: [ "PR (webitel-flow-manager)" ]
-    types: [ completed ]
-
-permissions: { contents: read }
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
-  cancel-in-progress: true
-
-jobs:
-  version:
-    name: Version
-    uses: webitel/reusable-workflows/.github/workflows/_version.yml@v2
-    permissions:
-      contents: read
-      id-token: write
-
-    if: |
-      github.event.workflow_run.head_repository.fork == false &&
-      github.event.workflow_run.conclusion == 'success'
-
-    with:
-      versioning: calver
-      development-branch: ${{ github.event.repository.default_branch }}
-      triggered-branch: ${{ github.event.workflow_run.head_branch }}
-      arch: ${{ vars.BUILD_ARCH }}
-      codename: ${{ vars.DEB_CODENAME }}
-
-  publish:
-    name: Publish .deb package (${{ matrix.arch }}/${{ matrix.codename }})
-    needs: [ version ]
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: ${{ fromJSON(needs.version.outputs.arch-matrix) }}
-        codename: ${{ fromJSON(needs.version.outputs.codename-matrix) }}
-
-    uses: webitel/reusable-workflows/.github/workflows/_publish-deb.yml@v2
-    permissions:
-      id-token: write
-      actions: read
-      contents: read
-
-    secrets:
-      DEB_S3_ACCESS_KEY_ID: ${{ secrets.DEB_S3_ACCESS_KEY_ID }}
-      DEB_S3_SECRET_ACCESS_KEY: ${{ secrets.DEB_S3_SECRET_ACCESS_KEY }}
-      REPO_SIGNING_KEY: ${{ secrets.REPO_SIGNING_KEY }}
-      REPO_SIGNING_KEY_PASSPHRASE: ${{ secrets.REPO_SIGNING_KEY_PASSPHRASE }}
-      DELIVERY_BOT_APP_PEM: ${{ secrets.DELIVERY_BOT_APP_PEM }}
-
-    with:
-      arch: ${{ matrix.arch }}
-      deb-package-pattern: "webitel-flow-manager*.deb"
-      deb-component: dev
-      deb-codename: ${{ matrix.codename }}
-      deb-s3-bucket-name: ${{ vars.DEB_S3_BUCKET_NAME }}
-      deb-s3-bucket-region: ${{ vars.DEB_S3_DEFAULT_REGION }}
-      deb-s3-endpoint: ${{ vars.DEB_S3_ENDPOINT }}
-      deb-s3-force-path-style: ${{ vars.DEB_S3_FORCE_PATH_STYLE == 'true' }}
-      github-app-client-id: ${{ vars.DELIVERY_BOT_CLIENT_ID }}
-      artifact-repository-owner: ${{ github.repository_owner }}
-      artifact-repository: ${{ github.event.repository.name }}
-      artifact-actions-run-id: ${{ github.event.workflow_run.id }}
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
new file mode 100644
index 00000000..424e8fcb
--- /dev/null
+++ b/.github/workflows/vulncheck.yml
@@ -0,0 +1,26 @@
+# Code generated by file-sync from webitel/reusable-configs. DO NOT EDIT.
+# Source: golang/workflows/vulncheck.yml.njk
+# Edit the source instead; local changes are overwritten on the next sync.
+
+name: Vulnerabilities
+
+on:
+  schedule:
+    - cron: "0 4 * * *"
+
+  workflow_dispatch:
+
+permissions: { contents: read }
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  govulncheck:
+    name: Scan
+    uses: webitel/reusable-workflows/.github/workflows/golang-vulncheck.yml@v2
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+