diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0a30165
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(actions)"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 69889c8..b7b5511 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -6,23 +6,35 @@ on:
     pull_request:
       branches: [ master ]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}${{ github.ref == 'refs/heads/master' && format('-{0}', github.sha) || '' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
 jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       -
         name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.0'
+          go-version: '1.26'
+          cache-dependency-path: |
+            go.sum
+            lib/go.sum
 
       -
         name: Verify dependencies
-        run: go mod verify
+        run: |
+          go mod verify
+          go -C lib mod verify
 
       -
         name: Build
@@ -30,4 +42,12 @@ jobs:
 
       -
         name: Run go vet
-        run: go vet ./...
+        run: |
+          go vet ./...
+          go -C lib vet ./...
+
+      -
+        name: Run tests
+        run: |
+          go test ./...
+          go -C lib test ./...
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f58f0c6..a04df19 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,27 +4,36 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing tag to build and publish
+        required: true
+
+permissions:
+  contents: write
 
 jobs:
   goreleaser:
-    runs-on: macos-latest
+    runs-on: macos-26
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
+          ref: ${{ inputs.tag }}
           fetch-depth: 0
       -
         name: Fetch all tags
         run: git fetch --force --tags
       -
         name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.0'
+          go-version: '1.26'
+          cache: false
       -
         name: Generate Homebrew tap token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: tap-token
         with:
           app-id: ${{ secrets.TAP_APP_ID }}
@@ -33,7 +42,7 @@ jobs:
           repositories: homebrew-note-cli
       -
         name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
           version: '~> v2'
@@ -43,7 +52,8 @@ jobs:
           TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
       -
         name: Upload assets
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: note-cli
           path: dist/*
+          retention-days: 7
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 93e98d8..ffeac85 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -1,5 +1,8 @@
 version: 2
 
+env:
+  - MACOSX_DEPLOYMENT_TARGET=15.0
+
 before:
   hooks:
     - go mod tidy
@@ -52,6 +55,15 @@ builds:
         goarm: 6
       - goos: windows
         goarch: arm64
+    hooks: &macos-minos-check
+      post:
+        - cmd: >-
+            sh -c 'case "$0" in darwin_*)
+            minos=$(otool -l "$1" | awk "/LC_BUILD_VERSION/{f=1} f && /minos/{print \$2; exit}");
+            echo "$1: minos $minos";
+            test "$minos" = "$MACOSX_DEPLOYMENT_TARGET";;
+            esac' "{{ .Target }}" "{{ .Path }}"
+          output: true
 
   -
     id: "notehub"
@@ -72,6 +84,7 @@ builds:
         goarm: 6
       - goos: windows
         goarch: arm64
+    hooks: *macos-minos-check
 
 checksum:
   name_template: 'checksums.txt'