diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index dbe4778..ccc2b20 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -3,7 +3,7 @@ name: 🚀 CD
 # Publishes the org's declarative GitHub state (deploy/) as a cosign-signed OCI
 # artifact consumed by the platform cluster's `github-config` tenant. There is
 # NO container image here — only manifests — so it delegates to the shared
-# manifests-only publish workflow in devantler-tech/reusable-workflows (the
+# manifests-only publish workflow in devantler-tech/actions (the
 # manifests-only sibling of publish-app.yaml).
 #
 # The OCI path is `github-config` (not the repo name) because `.github` is an
@@ -11,10 +11,12 @@ name: 🚀 CD
 #
 # Because signing runs INSIDE the reusable workflow, the cosign certificate
 # identity (OIDC subject) is that workflow's path —
-# https://github.com/devantler-tech/reusable-workflows/.github/workflows/publish-manifests.yaml@<ref>
+# https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>
 # — NOT this repo's cd.yaml. The platform `github-config` OCIRepository's
 # verify.matchOIDCIdentity.subject must match that (see
-# k8s/providers/hetzner/github/sync.yaml in devantler-tech/platform).
+# k8s/bases/apps/github-config/oci-repository.yaml in devantler-tech/platform),
+# so this repo's workflow-source swap MUST land only after the platform
+# verifier accepts the devantler-tech/actions subject.
 
 on:
   push:
@@ -35,6 +37,6 @@ jobs:
     # Renovate manages this pin, as it does for publish-app.yaml elsewhere.
     # The platform verifier matches `@.+$`, so the ref does not affect cosign
     # verification.
-    uses: devantler-tech/reusable-workflows/.github/workflows/publish-manifests.yaml@f974f62a8cb396130fa084d209ad1fc17e99b9fc # v5.6.1
+    uses: devantler-tech/actions/.github/workflows/publish-manifests.yaml@061b345a7351b0caf23055caea63ccd08b75e20e # v8.0.0
     with:
       oci-name: devantler-tech/github-config
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a61cfd9..0fc9722 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,6 +13,6 @@ permissions:
 
 jobs:
   release:
-    uses: devantler-tech/reusable-workflows/.github/workflows/create-release.yaml@c830916321473ec23bb612e41de963b9b01af897 # v5.6.6
+    uses: devantler-tech/actions/.github/workflows/create-release.yaml@061b345a7351b0caf23055caea63ccd08b75e20e # v8.0.0
     secrets:
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}