diff --git a/.github/workflows/hermetic-soft.yml b/.github/workflows/hermetic-soft.yml
index b09c9f27..04eecb90 100644
--- a/.github/workflows/hermetic-soft.yml
+++ b/.github/workflows/hermetic-soft.yml
@@ -4,6 +4,7 @@ name: Hermetic build (soft)
 
 on:
   pull_request:
+    branches: [main]
   push:
     branches: [main]
   workflow_dispatch:
diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml
index 2cc2150c..c9d50205 100644
--- a/.github/workflows/sast.yml
+++ b/.github/workflows/sast.yml
@@ -9,8 +9,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init-action@v4
+      - uses: github/codeql-action/init@v4
         with:
           languages: [typescript, python, rust, go]
-      - uses: github/codeql-action/autobuild
-      - uses: github/codeql-action/analyze
+      - uses: github/codeql-action/autobuild@v4
+      - uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index fae5367d..a9de6257 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ name: OpenSSF Scorecard
 
 on:
   branch_protection_rule:
+    types: [created, edited, deleted]
   schedule:
     - cron: '25 4 * * 1'  # Weekly Monday 4:25 UTC
   push:
@@ -20,8 +21,6 @@ jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
-    security:
-      permissions: read-all
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bdeef86c..78be0ef4 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -13,9 +13,6 @@ permissions:
   contents: read
   actions: read
 
-env:
-  
-
 jobs:
   # Secret Scanning
   secrets:
diff --git a/.mergify.yml b/.mergify.yml
index 7de2e29c..1c49a770 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -1,138 +1,14 @@
-# Mergify Configuration — Optimized for multi-language monorepos
-# Docs: https://docs.mergify.com/
-
 pull_request_rules:
-  # Auto-merge when all CI checks pass and PR is approved
-  - name: Auto-merge when approved + CI green
+  - name: auto-merge when approved and required checks green
     conditions:
-      - "#review-requested=0"
       - "#approved-reviews-by>=1"
-      - check-success=ci
-      - check-success=lint
-      - check-success=typecheck
-      - check-success=test
-      - -conflict
-      - -closed
+      - "check-success=ci / lint"
+      - "check-success=ci / test"
+      - "check-success=coverage"
+      - "-conflict"
+      - "-closed"
+      - "-draft"
     actions:
       merge:
         method: squash
-        commit_message_template: |
-          {{ title }} (#{{ number }})
-          
-          Co-authored-by: {{ author }}
-      post_merge:
-        action: close
-
-  # Auto-merge dependabot/Renovate PRs when CI passes
-  - name: Auto-merge dependency updates
-    conditions:
-      - author=dependabot[bot] | renovate[bot]
-      - check-success=ci
-      - -conflict
-      - -closed
-    actions:
-      merge:
-        method: squash
-        commit_message_template: |
-          {{ title }} (#{{ number }})
-          
-          Co-authored-by: {{ author }}
-      post_merge:
-        action: close
-
-  # Auto-merge bot PRs (CI configs, formatting) when CI passes
-  - name: Auto-merge bot housekeeping PRs
-    conditions:
-      - author=trunk-io[bot] | mergify[bot] | github-actions[bot]
-      - check-success=ci
-      - check-success=lint
-      - -conflict
-      - -closed
-    actions:
-      merge:
-        method: squash
-
-  # Add reviewers based on changed paths
-  - name: Request review from team
-    conditions:
-      - -closed
-      - -draft
-    actions:
-      request_reviews:
-        teams:
-          - phenotype/core
-        github_accounts:
-          - KooshaPari
-
-  # Label PRs based on changed files
-  - name: Label Python changes
-    conditions:
-      - files~=\.py$
-    actions:
-      label:
-        add:
-          - python
-
-  - name: Label Rust changes
-    conditions:
-      - files~=\.rs$|Cargo\.
-    actions:
-      label:
-        add:
-          - rust
-
-  - name: Label Go changes
-    conditions:
-      - files~=\.go$|go\.
-    actions:
-      label:
-        add:
-          - go
-
-  - name: Label TypeScript changes
-    conditions:
-      - files~=\.ts$|\.tsx$|package\.json
-    actions:
-      label:
-        add:
-          - typescript
-
-  # Close stale PRs after 30 days
-  - name: Close stale PRs
-    conditions:
-      - -closed
-      - -draft
-      - age>=30d
-      - "#review-requested=0"
-    actions:
-      comment:
-        message: >
-          This PR has been automatically closed after 30 days of inactivity.
-          Feel free to reopen if still relevant.
-      close: {}
-
-  # Warn on large PRs
-  - name: Warn on large PRs
-    conditions:
-      - -closed
-      - -draft
-      - "#files>20"
-    actions:
-      comment:
-        message: >
-          **Large PR Alert**: This PR touches {{ number }} files.
-          Consider splitting into smaller PRs for easier review.
-
-  # Add ready-to-merge label when all checks pass
-  - name: Add ready-to-merge label
-    conditions:
-      - -closed
-      - -draft
-      - check-success=ci
-      - check-success=lint
-      - check-success=test
-      - "#approved-reviews-by>=1"
-    actions:
-      label:
-        add:
-          - ready-to-merge
+      delete_head_branch: {}