diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5823b91..8e12dec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
           # REPO_ACCESS_TOKEN is a fine-grained PAT with read on the private
           # sibling repos; GITHUB_TOKEN is scoped to THIS repo only and 404s.
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _proto_ci
       - run: mv _proto_ci ../proto
 
@@ -69,7 +69,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _common_ci
       - run: mv _common_ci ../common
 
@@ -83,7 +83,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _api_ci
           fetch-depth: 1
       - run: mv _api_ci ../api
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index b2f1e3c..99c9ecc 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -71,24 +71,24 @@ jobs:
       # the drift-detection coverage. Mirrors ci.yml.
       INSTANT_API_REPO: ${{ github.workspace }}/../api
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           path: worker
           # Full history so diff-cover can resolve origin/<base_ref>.
           fetch-depth: 0
 
       - name: Checkout proto sibling (for go.mod replace ../proto)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: proto
 
       - name: Checkout common sibling (for go.mod replace ../common)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.COMMON_REPO || format('{0}/common', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: common
 
       # Cross-repo registry-iterating tests (CLAUDE.md rule 18) text-walk
@@ -97,15 +97,15 @@ jobs:
       # in CI, leaving cross-repo drift detection to developer machines
       # only. INSTANT_API_REPO env (set above) locates this checkout.
       - name: Checkout api sibling (for cross-repo registry-iterating tests)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: _api_ci
           fetch-depth: 1
       - run: mv _api_ci ../api
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: worker/go.mod
 
@@ -153,7 +153,7 @@ jobs:
         continue-on-error: true
         run: go test ./... -short -count=1 -p 1 -coverprofile=coverage.out -covermode=atomic
 
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         with:
           files: worker/coverage.out
           flags: worker
@@ -166,7 +166,7 @@ jobs:
       # "Generate coverage" step is `|| true` so it still produces
       # coverage.out even on a flaky test — the gate reads that file.
       # ------------------------------------------------------------------
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         if: github.event_name == 'pull_request'
         with:
           python-version: '3.12'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a0a1ddb..ce5f209 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -70,14 +70,14 @@ jobs:
           # on private sibling repos in the same org. REPO_ACCESS_TOKEN
           # is a fine-grained PAT with read access to
           # InstaNode-dev/{common,proto}.
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: common
 
       - name: Checkout proto sibling into ./proto
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.PROTO_REPO || format('{0}/proto', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: proto
 
       # Cross-repo registry-iterating tests (CLAUDE.md rule 18) text-walk
@@ -90,7 +90,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }}
-          token: ${{ secrets.REPO_ACCESS_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}
           path: api
           fetch-depth: 1
 
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index c097451..8ede56b 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -18,26 +18,26 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           path: worker
       # Sibling checkouts (proto/common) for repos with replace directives.
       # No-op for repos that do not need them.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: ${{ hashFiles('worker/go.mod') != '' }}
         with:
           repository: InstaNode-dev/common
           path: common
         continue-on-error: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           repository: InstaNode-dev/proto
           path: proto
         continue-on-error: true
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: worker/go.mod
-      - uses: golangci/golangci-lint-action@v8
+      - uses: golangci/golangci-lint-action@v9
         with:
           # Pinned (was `latest`) so a new upstream release can't silently
           # introduce analyzers/findings that fail a previously-green PR —
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 5e46750..2c07a4d 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: lycheeverse/lychee-action@v2
         with:
           args: --no-progress --max-concurrency 4 --exclude-mail './**/*.md' './**/*.html'
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index d25ee6b..9039154 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v4
-      - uses: crate-ci/typos@v1.30.0
+      - uses: actions/checkout@v6
+      - uses: crate-ci/typos@v1.46.3
         continue-on-error: true  # warn-only — surface findings without blocking CI