diff --git a/.github/scripts/terragrunt-release/test.sh b/.github/scripts/terragrunt-release/test.sh
index 9c18da7a..59bb7f4e 100755
--- a/.github/scripts/terragrunt-release/test.sh
+++ b/.github/scripts/terragrunt-release/test.sh
@@ -332,22 +332,22 @@ YAML
 test_deploy_trigger_applies_only_merge_targets() {
     local expected="\${{ matrix.target.stack == 'terragrunt' && (github.event_name == 'pull_request' && 'plan' || (matrix.target.apply_trigger == 'merge' && 'apply' || '')) || '' }}"
     local actual
-    actual="$(yq '.jobs.deploy-terragrunt.with.action-type' "${repo_root}/.github/workflows/auto-label--deploy-trigger.yaml")"
+    actual="$(yq '.jobs.deploy-terragrunt.with.action-type' "${repo_root}/.github/workflows/label-base-deploy--resolver.yaml")"
     assert_eq "${expected}" "${actual}"
 }
 
 test_deploy_trigger_excludes_shared_targets() {
     local job stack
     for job in deploy-terragrunt deploy-kubernetes; do
-        stack="$(yq ".jobs.${job}.strategy.matrix.exclude[] | select(.target.stack == \"terragrunt-shared\") | .target.stack" "${repo_root}/.github/workflows/auto-label--deploy-trigger.yaml")"
+        stack="$(yq ".jobs.${job}.strategy.matrix.exclude[] | select(.target.stack == \"terragrunt-shared\") | .target.stack" "${repo_root}/.github/workflows/label-base-deploy--resolver.yaml")"
         assert_eq "terragrunt-shared" "${stack}"
     done
 }
 
 test_release_workflows_skip_empty_targets() {
     local expected="needs.resolve.outputs.targets != '[]'"
-    assert_eq "${expected}" "$(yq '.jobs.plan.if' "${repo_root}/.github/workflows/auto-release--plan.yaml")"
-    assert_eq "${expected}" "$(yq '.jobs.apply.if' "${repo_root}/.github/workflows/auto-release--trigger.yaml")"
+    assert_eq "${expected}" "$(yq '.jobs.plan.if' "${repo_root}/.github/workflows/release--plan.yaml")"
+    assert_eq "${expected}" "$(yq '.jobs.apply.if' "${repo_root}/.github/workflows/release--deploy.yaml")"
 }
 
 test_repository_config_excludes_production() {
diff --git a/.github/workflows/ci-gatekeeper.yaml b/.github/workflows/ci-gatekeeper.yaml
index 54f6aa87..a68a8daa 100644
--- a/.github/workflows/ci-gatekeeper.yaml
+++ b/.github/workflows/ci-gatekeeper.yaml
@@ -1,3 +1,4 @@
+# Waits for every other workflow on a pull request so that one required check gates the merge.
 name: 'CI Gatekeeper'
 
 on:
diff --git a/.github/workflows/auto-label--label-dispatcher.yaml b/.github/workflows/label-base-deploy--dispatcher.yaml
similarity index 91%
rename from .github/workflows/auto-label--label-dispatcher.yaml
rename to .github/workflows/label-base-deploy--dispatcher.yaml
index b5073c6c..6e9f35c2 100644
--- a/.github/workflows/auto-label--label-dispatcher.yaml
+++ b/.github/workflows/label-base-deploy--dispatcher.yaml
@@ -1,4 +1,5 @@
-name: 'Auto Label - Label Dispatcher'
+# Adds deploy:{service} labels to a pull request from the stack paths it changes.
+name: 'Label Base Deploy - Dispatcher'
 
 on:
   pull_request:
diff --git a/.github/workflows/auto-label--deploy-trigger.yaml b/.github/workflows/label-base-deploy--resolver.yaml
similarity index 78%
rename from .github/workflows/auto-label--deploy-trigger.yaml
rename to .github/workflows/label-base-deploy--resolver.yaml
index a0c2753b..2c35809b 100644
--- a/.github/workflows/auto-label--deploy-trigger.yaml
+++ b/.github/workflows/label-base-deploy--resolver.yaml
@@ -1,4 +1,5 @@
-name: 'Auto Label - Label Resolver'
+# Resolves deploy labels into targets, plans them on pull requests, and applies apply_trigger: merge targets on push to main.
+name: 'Label Base Deploy - Resolver'
 
 on:
   pull_request:
@@ -15,12 +16,12 @@ permissions:
   pull-requests: write
 
 concurrency:
-  group: deploy-trigger-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  group: label-base-deploy-resolver-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  deploy-trigger:
-    name: 'Deployment Trigger'
+  resolve:
+    name: 'Resolve Targets'
     runs-on: ubuntu-latest
     outputs:
       targets: ${{ steps.resolver.outputs.targets }}
@@ -59,10 +60,10 @@ jobs:
 
   kubernetes-targets-group:
     name: 'Group Kubernetes Targets by Environment'
-    needs: deploy-trigger
+    needs: resolve
     if: |
-      needs.deploy-trigger.outputs.has-targets == 'true' &&
-      contains(needs.deploy-trigger.outputs.targets, '"stack":"kubernetes"')
+      needs.resolve.outputs.has-targets == 'true' &&
+      contains(needs.resolve.outputs.targets, '"stack":"kubernetes"')
     runs-on: ubuntu-latest
     outputs:
       environments: ${{ steps.group.outputs.environments }}
@@ -70,7 +71,7 @@ jobs:
       - name: Group by environment
         id: group
         env:
-          TARGETS: ${{ needs.deploy-trigger.outputs.targets }}
+          TARGETS: ${{ needs.resolve.outputs.targets }}
         run: |
           set -euo pipefail
           grouped=$(echo "$TARGETS" | jq -c '
@@ -97,13 +98,13 @@ jobs:
 
   deploy-terragrunt:
     name: 'Deploy Terragrunt (${{ matrix.target.service }}:${{ matrix.target.environment }})'
-    needs: deploy-trigger
+    needs: resolve
     if: |
-      needs.deploy-trigger.outputs.has-targets == 'true' &&
-      contains(needs.deploy-trigger.outputs.targets, '"stack":"terragrunt"')
+      needs.resolve.outputs.has-targets == 'true' &&
+      contains(needs.resolve.outputs.targets, '"stack":"terragrunt"')
     strategy:
       matrix:
-        target: ${{ fromJson(needs.deploy-trigger.outputs.targets) }}
+        target: ${{ fromJson(needs.resolve.outputs.targets) }}
         exclude:
           - target:
               stack: terragrunt-shared
@@ -122,13 +123,13 @@ jobs:
 
   deploy-kubernetes:
     name: 'Deploy Kubernetes (${{ matrix.target.service }}:${{ matrix.target.environment }})'
-    needs: [deploy-trigger, deploy-kubernetes-hydrate]
+    needs: [resolve, deploy-kubernetes-hydrate]
     if: |
-      needs.deploy-trigger.outputs.has-targets == 'true' &&
-      contains(needs.deploy-trigger.outputs.targets, '"stack":"kubernetes"')
+      needs.resolve.outputs.has-targets == 'true' &&
+      contains(needs.resolve.outputs.targets, '"stack":"kubernetes"')
     strategy:
       matrix:
-        target: ${{ fromJson(needs.deploy-trigger.outputs.targets) }}
+        target: ${{ fromJson(needs.resolve.outputs.targets) }}
         exclude:
           - target:
               stack: terragrunt
@@ -145,8 +146,8 @@ jobs:
 
   deployment-summary:
     name: 'Deployment Summary'
-    needs: [deploy-trigger, deploy-terragrunt, deploy-kubernetes-hydrate, deploy-kubernetes]
-    if: always() && needs.deploy-trigger.outputs.has-targets == 'true'
+    needs: [resolve, deploy-terragrunt, deploy-kubernetes-hydrate, deploy-kubernetes]
+    if: always() && needs.resolve.outputs.has-targets == 'true'
     runs-on: ubuntu-latest
     steps:
       - name: Summary
@@ -154,9 +155,9 @@ jobs:
           echo "📊 Deployment Summary"
           echo "Event: ${{ github.event_name }}"
           echo "Branch: ${{ github.ref_name }}"
-          echo "Environment: ${{ needs.deploy-trigger.outputs.target-environment }}"
-          echo "Safety Status: ${{ needs.deploy-trigger.outputs.safety-status }}"
-          echo "Targets: ${{ needs.deploy-trigger.outputs.targets }}"
+          echo "Environment: ${{ needs.resolve.outputs.target-environment }}"
+          echo "Safety Status: ${{ needs.resolve.outputs.safety-status }}"
+          echo "Targets: ${{ needs.resolve.outputs.targets }}"
           echo "Terragrunt Job Status: ${{ needs.deploy-terragrunt.result }}"
           echo "Kubernetes Job Status: ${{ needs.deploy-kubernetes.result }}"
           echo "Kubernetes Hydrate Job Status: ${{ needs.deploy-kubernetes-hydrate.result }}"
diff --git a/.github/workflows/lint-actions.yml b/.github/workflows/lint-actions.yml
index 5bfcfb87..9d7bb5ad 100644
--- a/.github/workflows/lint-actions.yml
+++ b/.github/workflows/lint-actions.yml
@@ -1,3 +1,4 @@
+# Checks that every action is pinned to a full commit SHA.
 name: Lint GitHub Actions
 
 on:
diff --git a/.github/workflows/auto-release--trigger.yaml b/.github/workflows/release--deploy.yaml
similarity index 90%
rename from .github/workflows/auto-release--trigger.yaml
rename to .github/workflows/release--deploy.yaml
index a649273a..ff758128 100644
--- a/.github/workflows/auto-release--trigger.yaml
+++ b/.github/workflows/release--deploy.yaml
@@ -1,4 +1,5 @@
-name: 'Auto Release - Trigger'
+# Applies a service's apply_trigger: release environments when its release is published or its tag is dispatched.
+name: 'Release - Deploy'
 
 on:
   release:
@@ -16,7 +17,7 @@ permissions:
   pull-requests: write
 
 concurrency:
-  group: auto-release-trigger-${{ github.event.release.tag_name || inputs.tag }}
+  group: release-deploy-${{ github.event.release.tag_name || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
diff --git a/.github/workflows/auto-release--plan.yaml b/.github/workflows/release--plan.yaml
similarity index 91%
rename from .github/workflows/auto-release--plan.yaml
rename to .github/workflows/release--plan.yaml
index 6da45010..c5cc0334 100644
--- a/.github/workflows/auto-release--plan.yaml
+++ b/.github/workflows/release--plan.yaml
@@ -1,4 +1,5 @@
-name: 'Auto Release - Plan'
+# Plans a service's apply_trigger: release environments on its release-please pull request.
+name: 'Release - Plan'
 
 on:
   pull_request:
@@ -10,7 +11,7 @@ permissions:
   pull-requests: write
 
 concurrency:
-  group: auto-release-plan-${{ github.head_ref }}
+  group: release-plan-${{ github.head_ref }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release--please.yaml
similarity index 91%
rename from .github/workflows/release.yml
rename to .github/workflows/release--please.yaml
index 05beb1ea..abd973bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release--please.yaml
@@ -1,4 +1,5 @@
-name: Release
+# Runs release-please for each aws/{service} config to open release pull requests and publish releases.
+name: 'Release - Please'
 
 on:
   push:
diff --git a/.github/workflows/renovate-major-review.yaml b/.github/workflows/renovate-major-review.yaml
index c58f1d33..a1d24a84 100644
--- a/.github/workflows/renovate-major-review.yaml
+++ b/.github/workflows/renovate-major-review.yaml
@@ -1,3 +1,4 @@
+# Reviews Renovate major-update pull requests with Claude on Bedrock and posts the review.
 name: 'Renovate Major Review'
 
 on:
diff --git a/.github/workflows/reusable--kubernetes-builder.yaml b/.github/workflows/reusable--kubernetes-builder.yaml
index 1acedd57..816e6168 100644
--- a/.github/workflows/reusable--kubernetes-builder.yaml
+++ b/.github/workflows/reusable--kubernetes-builder.yaml
@@ -1,3 +1,4 @@
+# Posts the kustomize diff of one hydrated component as a pull request comment.
 name: 'Reusable - Kubernetes Builder'
 
 on:
diff --git a/.github/workflows/reusable--kubernetes-hydrator.yaml b/.github/workflows/reusable--kubernetes-hydrator.yaml
index 8e3f83ac..3f6d2b70 100644
--- a/.github/workflows/reusable--kubernetes-hydrator.yaml
+++ b/.github/workflows/reusable--kubernetes-hydrator.yaml
@@ -1,3 +1,4 @@
+# Renders the given components into kubernetes/manifests and commits the result to the pull request branch.
 name: 'Reusable - Kubernetes Hydrator'
 
 on:
diff --git a/.github/workflows/reusable--terragrunt-executor.yaml b/.github/workflows/reusable--terragrunt-executor.yaml
index 24d7d7be..41c451e5 100644
--- a/.github/workflows/reusable--terragrunt-executor.yaml
+++ b/.github/workflows/reusable--terragrunt-executor.yaml
@@ -1,3 +1,4 @@
+# Runs terragrunt plan or apply in one working directory and reports the result with tfcmt.
 name: 'Reusable - Terragrunt Executor'
 
 on:
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index aced0ebb..a9393ed5 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -1,3 +1,4 @@
+# Validates that the pull request title follows Conventional Commits.
 name: Semantic Pull Request
 
 on:
diff --git a/.github/workflows/test-terragrunt-release.yaml b/.github/workflows/test-terragrunt-release.yaml
index 50beaac2..414f8aea 100644
--- a/.github/workflows/test-terragrunt-release.yaml
+++ b/.github/workflows/test-terragrunt-release.yaml
@@ -1,3 +1,4 @@
+# Tests the terragrunt release scripts and validates workflow-config.yaml and the release-please configs.
 name: Test Terragrunt Release
 
 on:
diff --git a/README-ja.md b/README-ja.md
index 1adea03e..48775298 100644
--- a/README-ja.md
+++ b/README-ja.md
@@ -37,14 +37,14 @@
 
 | Event | Workflow | Terragrunt |
 |-------|----------|------------|
-| PR に `deploy:{service}` ラベルが付く | [auto-label--deploy-trigger.yaml](.github/workflows/auto-label--deploy-trigger.yaml) | すべての target を plan |
-| `main` への push | [auto-label--deploy-trigger.yaml](.github/workflows/auto-label--deploy-trigger.yaml) | `apply_trigger: merge` の target を apply |
-| release PR の作成・更新 | [auto-release--plan.yaml](.github/workflows/auto-release--plan.yaml) | その service の `apply_trigger: release` の environment を plan |
-| release の公開 | [auto-release--trigger.yaml](.github/workflows/auto-release--trigger.yaml) | その service の `apply_trigger: release` の environment を apply |
+| PR に `deploy:{service}` ラベルが付く | [label-base-deploy--resolver.yaml](.github/workflows/label-base-deploy--resolver.yaml) | すべての target を plan |
+| `main` への push | [label-base-deploy--resolver.yaml](.github/workflows/label-base-deploy--resolver.yaml) | `apply_trigger: merge` の target を apply |
+| release PR の作成・更新 | [release--plan.yaml](.github/workflows/release--plan.yaml) | その service の `apply_trigger: release` の environment を plan |
+| release の公開 | [release--deploy.yaml](.github/workflows/release--deploy.yaml) | その service の `apply_trigger: release` の environment を apply |
 
 #### Targets
 
-- PR の作成・更新時に、[auto-label--label-dispatcher.yaml](.github/workflows/auto-label--label-dispatcher.yaml) が `deploy:{service}` ラベルを付ける。release-please の branch にはラベルを付けない。
+- PR の作成・更新時に、[label-base-deploy--dispatcher.yaml](.github/workflows/label-base-deploy--dispatcher.yaml) が `deploy:{service}` ラベルを付ける。release-please の branch にはラベルを付けない。
   - module や `root.hcl` を含め、`aws/{service}/` 配下のどの変更でもラベルが付く。
 - `label-resolver` が [workflow-config.yaml](workflow-config.yaml) を使って、ラベルをその service の全 environment に展開する。
 - `terragrunt` stack の `exclude` に一致する `{service}/{environment}` の組は、release も含めて plan も apply もされない。
@@ -56,8 +56,8 @@
   - 設定がないと [check-release-configs.sh](.github/scripts/terragrunt-release/check-release-configs.sh) が CI を失敗させる。
 - `apply_trigger: merge` の environment ディレクトリだけを変える commit は、release を作らない（`exclude-paths`）。
 - `apply_trigger: release` の environment がすべて除外されている間も release PR は作られるが、plan も apply もされない。
-- plan を出し直すときは、`auto-release--plan` の run で「Re-run all jobs」を使う。
-- apply を再実行するときは、`gh workflow run auto-release--trigger.yaml --ref {service}-vX.Y.Z -f tag={service}-vX.Y.Z` を実行する。
+- plan を出し直すときは、`Release - Plan` の run で「Re-run all jobs」を使う。
+- apply を再実行するときは、`gh workflow run release--deploy.yaml --ref {service}-vX.Y.Z -f tag={service}-vX.Y.Z` を実行する。
 
 ### Stacks
 
@@ -86,8 +86,8 @@ flowchart LR
   end
 
   subgraph Labeling
-    Dispatcher[auto-label--label-dispatcher<br/>panicboat/deploy-actions/label-dispatcher]
-    Trigger[auto-label--deploy-trigger<br/>on: pull_request labeled]
+    Dispatcher[label-base-deploy--dispatcher<br/>panicboat/deploy-actions/label-dispatcher]
+    Trigger[label-base-deploy--resolver<br/>on: pull_request labeled]
     Resolver[label-resolver]
   end
 
@@ -101,7 +101,7 @@ flowchart LR
   end
 
   subgraph Terragrunt
-    ReleaseTrigger[auto-release--trigger]
+    ReleaseTrigger[release--deploy]
     TG[reusable--terragrunt-executor]
     Plan[terragrunt plan]
     Apply[terragrunt apply]
diff --git a/README.md b/README.md
index e3c6da66..b13a7ab8 100644
--- a/README.md
+++ b/README.md
@@ -37,14 +37,14 @@ A PR labeled by `panicboat/deploy-actions` is resolved against [workflow-config.
 
 | Event | Workflow | Terragrunt |
 |-------|----------|------------|
-| `deploy:{service}` label added to a PR | [auto-label--deploy-trigger.yaml](.github/workflows/auto-label--deploy-trigger.yaml) | plan every target |
-| Push to `main` | [auto-label--deploy-trigger.yaml](.github/workflows/auto-label--deploy-trigger.yaml) | apply targets with `apply_trigger: merge` |
-| Release PR opened / updated | [auto-release--plan.yaml](.github/workflows/auto-release--plan.yaml) | plan the service's `apply_trigger: release` environments |
-| Release published | [auto-release--trigger.yaml](.github/workflows/auto-release--trigger.yaml) | apply the service's `apply_trigger: release` environments |
+| `deploy:{service}` label added to a PR | [label-base-deploy--resolver.yaml](.github/workflows/label-base-deploy--resolver.yaml) | plan every target |
+| Push to `main` | [label-base-deploy--resolver.yaml](.github/workflows/label-base-deploy--resolver.yaml) | apply targets with `apply_trigger: merge` |
+| Release PR opened / updated | [release--plan.yaml](.github/workflows/release--plan.yaml) | plan the service's `apply_trigger: release` environments |
+| Release published | [release--deploy.yaml](.github/workflows/release--deploy.yaml) | apply the service's `apply_trigger: release` environments |
 
 #### Targets
 
-- [auto-label--label-dispatcher.yaml](.github/workflows/auto-label--label-dispatcher.yaml) adds `deploy:{service}` to a PR when it is opened or updated; release-please branches get no label.
+- [label-base-deploy--dispatcher.yaml](.github/workflows/label-base-deploy--dispatcher.yaml) adds `deploy:{service}` to a PR when it is opened or updated; release-please branches get no label.
   - Any change under `aws/{service}/`, including modules and `root.hcl`, adds the label.
 - `label-resolver` expands the label into every environment of that service using [workflow-config.yaml](workflow-config.yaml).
 - A `{service}/{environment}` pair matched by `exclude` of the `terragrunt` stack is never planned or applied, including by releases.
@@ -56,8 +56,8 @@ A PR labeled by `panicboat/deploy-actions` is resolved against [workflow-config.
   - [check-release-configs.sh](.github/scripts/terragrunt-release/check-release-configs.sh) fails CI when a config is missing.
 - Commits that touch only `apply_trigger: merge` environment directories do not create a release (`exclude-paths`).
 - While every `apply_trigger: release` environment is excluded, the release PR is still created, but nothing is planned or applied.
-- To re-plan, use "Re-run all jobs" on the `auto-release--plan` run.
-- To re-apply, run `gh workflow run auto-release--trigger.yaml --ref {service}-vX.Y.Z -f tag={service}-vX.Y.Z`.
+- To re-plan, use "Re-run all jobs" on the `Release - Plan` run.
+- To re-apply, run `gh workflow run release--deploy.yaml --ref {service}-vX.Y.Z -f tag={service}-vX.Y.Z`.
 
 ### Stacks
 
@@ -86,8 +86,8 @@ flowchart LR
   end
 
   subgraph Labeling
-    Dispatcher[auto-label--label-dispatcher<br/>panicboat/deploy-actions/label-dispatcher]
-    Trigger[auto-label--deploy-trigger<br/>on: pull_request labeled]
+    Dispatcher[label-base-deploy--dispatcher<br/>panicboat/deploy-actions/label-dispatcher]
+    Trigger[label-base-deploy--resolver<br/>on: pull_request labeled]
     Resolver[label-resolver]
   end
 
@@ -101,7 +101,7 @@ flowchart LR
   end
 
   subgraph Terragrunt
-    ReleaseTrigger[auto-release--trigger]
+    ReleaseTrigger[release--deploy]
     TG[reusable--terragrunt-executor]
     Plan[terragrunt plan]
     Apply[terragrunt apply]