diff --git a/.github/workflows/ci-gatekeeper.yaml b/.github/workflows/ci-gatekeeper.yaml
index 361d16f4..59650650 100644
--- a/.github/workflows/ci-gatekeeper.yaml
+++ b/.github/workflows/ci-gatekeeper.yaml
@@ -11,7 +11,7 @@ jobs:
   ci-gatekeeper:
     permissions:
       actions: read
-    uses: panicboat/.github/.github/workflows/reusable--ci-gatekeeper.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--ci-gatekeeper.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       # The AI review is advisory; an Anthropic API outage must not block merges through this required check.
       exclude-workflow-names: Renovate Major Review
diff --git a/.github/workflows/label-base-deploy--dispatcher.yaml b/.github/workflows/label-base-deploy--dispatcher.yaml
index 14d75a72..0082bc42 100644
--- a/.github/workflows/label-base-deploy--dispatcher.yaml
+++ b/.github/workflows/label-base-deploy--dispatcher.yaml
@@ -13,7 +13,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-    uses: panicboat/.github/.github/workflows/reusable--label-base-deploy--dispatcher.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--label-base-deploy--dispatcher.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/label-base-deploy--resolver.yaml b/.github/workflows/label-base-deploy--resolver.yaml
index 0a6415ae..99fc389d 100644
--- a/.github/workflows/label-base-deploy--resolver.yaml
+++ b/.github/workflows/label-base-deploy--resolver.yaml
@@ -20,7 +20,7 @@ jobs:
       id-token: write
       contents: write # the helmfile hydrator pushes hydrated manifests
       pull-requests: write
-    uses: panicboat/.github/.github/workflows/reusable--label-base-deploy--resolver.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--label-base-deploy--resolver.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/lint-actions.yml b/.github/workflows/lint-actions.yml
index a05997e6..1c12918f 100644
--- a/.github/workflows/lint-actions.yml
+++ b/.github/workflows/lint-actions.yml
@@ -10,4 +10,4 @@ jobs:
   ensure-sha-pinned:
     permissions:
       contents: read
-    uses: panicboat/.github/.github/workflows/reusable--lint-actions.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--lint-actions.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
diff --git a/.github/workflows/release--deploy.yaml b/.github/workflows/release--deploy.yaml
index c5283509..fdff0740 100644
--- a/.github/workflows/release--deploy.yaml
+++ b/.github/workflows/release--deploy.yaml
@@ -21,7 +21,7 @@ jobs:
       id-token: write
       contents: read
       pull-requests: write
-    uses: panicboat/.github/.github/workflows/reusable--release--deploy.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--release--deploy.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/release--plan.yaml b/.github/workflows/release--plan.yaml
index 223486c5..9885ecc9 100644
--- a/.github/workflows/release--plan.yaml
+++ b/.github/workflows/release--plan.yaml
@@ -15,7 +15,7 @@ jobs:
       id-token: write
       contents: read
       pull-requests: write
-    uses: panicboat/.github/.github/workflows/reusable--release--plan.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--release--plan.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/release--please.yaml b/.github/workflows/release--please.yaml
index 5f0e5301..9a0feee9 100644
--- a/.github/workflows/release--please.yaml
+++ b/.github/workflows/release--please.yaml
@@ -14,7 +14,7 @@ jobs:
   release-please:
     permissions:
       contents: read
-    uses: panicboat/.github/.github/workflows/reusable--release--please.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--release--please.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index a2e5238e..03b28fde 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -9,7 +9,7 @@ jobs:
   validate:
     permissions:
       contents: read
-    uses: panicboat/.github/.github/workflows/reusable--semantic-pull-request.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--semantic-pull-request.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0
     with:
       app-id: ${{ vars.APP_ID }}
     secrets:
diff --git a/.github/workflows/test-terragrunt-release.yaml b/.github/workflows/test-terragrunt-release.yaml
index 204128b5..35ca4b94 100644
--- a/.github/workflows/test-terragrunt-release.yaml
+++ b/.github/workflows/test-terragrunt-release.yaml
@@ -10,4 +10,4 @@ jobs:
   validate:
     permissions:
       contents: read
-    uses: panicboat/.github/.github/workflows/reusable--test-terragrunt-release.yaml@d54532665675f1843914da4b324dc2a58dd37239 # v1.0.0
+    uses: panicboat/.github/.github/workflows/reusable--test-terragrunt-release.yaml@cf98ce094f5e91cfc9072b5e401d9ed371bf0719 # v3.0.0