diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 053955d..3f10e05 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,11 +16,14 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install lint tools
+        env:
+          # Authenticated downloads: anonymous GitHub Releases downloads can fail when github.com is degraded.
+          GH_TOKEN: ${{ github.token }}
         run: |
           sudo apt-get update
           sudo apt-get install -y shellcheck
-          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz -o /tmp/actionlint_1.7.7_linux_amd64.tar.gz
-          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_checksums.txt -o /tmp/checksums.txt
+          gh release download v1.7.7 --repo rhysd/actionlint --dir /tmp --pattern actionlint_1.7.7_linux_amd64.tar.gz
+          gh release download v1.7.7 --repo rhysd/actionlint --pattern actionlint_1.7.7_checksums.txt --output /tmp/checksums.txt
           (cd /tmp && sha256sum --check --ignore-missing checksums.txt)
           tar -xzf /tmp/actionlint_1.7.7_linux_amd64.tar.gz -C /tmp actionlint
           python -m pip install zizmor==1.31.1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9cbf1ad..59aecbc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes are documented here, following [Keep a Changelog](https://ke
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-11-08
+
 ### Added
 - Composite runner selection with GitHub and capacity service sources.
 - Optional federated private networking, reference service, tests and maintenance workflows.