diff --git a/.github/workflows/backend-ci.yaml b/.github/workflows/backend-ci.yaml
index b0e403988..7f2daca7b 100644
--- a/.github/workflows/backend-ci.yaml
+++ b/.github/workflows/backend-ci.yaml
@@ -1,9 +1,8 @@
-name: CI
+name: Backend CI
 
 on:
   push:
     branches:
-      - main
       - '[0-9]+.[0-9]+'
   pull_request: ~
   workflow_dispatch:
@@ -17,29 +16,33 @@ on:
 jobs:
   cs-fix:
     name: Run code style check
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     strategy:
       matrix:
         php:
           - '8.0'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ibexa/gh-workflows/actions/setup-composer-root-version@main
 
       - uses: ibexa/gh-workflows/actions/composer-install@main
         with:
+            php-version: ${{ matrix.php }}
             gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
             gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
             satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
             satis-network-token: ${{ secrets.SATIS_NETWORK_TOKEN }}
 
       - name: Run code style check
-        run: composer run-script check-cs -- --format=checkstyle | cs2pr
+        shell: bash
+        run: |
+          set -euo pipefail
+          composer run-script check-cs -- --format=checkstyle | cs2pr
 
   tests:
     name: Tests
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     timeout-minutes: 10
 
     strategy:
@@ -51,12 +54,13 @@ jobs:
           - '8.4'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: ibexa/gh-workflows/actions/setup-composer-root-version@main
 
       - uses: ibexa/gh-workflows/actions/composer-install@main
         with:
+          php-version: ${{ matrix.php }}
           gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
           gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
           satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
@@ -88,7 +92,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
           --tmpfs /var/lib/postgresql/data
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     timeout-minutes: 20
 
     strategy:
@@ -99,12 +103,13 @@ jobs:
           - '8.4'
 
     steps:
-      -   uses: actions/checkout@v6
+      -   uses: actions/checkout@v7
 
       -   uses: ibexa/gh-workflows/actions/setup-composer-root-version@main
 
       -   uses: ibexa/gh-workflows/actions/composer-install@main
           with:
+            php-version: ${{ matrix.php }}
             gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
             gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
             satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
@@ -139,7 +144,7 @@ jobs:
           --health-timeout=5s
           --health-retries=5
           --tmpfs=/var/lib/mysql
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     timeout-minutes: 20
 
     strategy:
@@ -151,12 +156,13 @@ jobs:
           - '8.4'
 
     steps:
-      -   uses: actions/checkout@v6
+      -   uses: actions/checkout@v7
 
       -   uses: ibexa/gh-workflows/actions/setup-composer-root-version@main
 
       -   uses: ibexa/gh-workflows/actions/composer-install@main
           with:
+            php-version: ${{ matrix.php }}
             gh-client-id: ${{ secrets.AUTOMATION_CLIENT_ID }}
             gh-client-secret: ${{ secrets.AUTOMATION_CLIENT_SECRET }}
             satis-network-key: ${{ secrets.SATIS_NETWORK_KEY }}
@@ -175,7 +181,7 @@ jobs:
     name: Notify Slack
     needs: [cs-fix, tests, integration-tests-postgres, integration-tests-mysql]
     if: always() && github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-26.04"
     steps:
       - name: Determine overall result
         id: result
@@ -199,7 +205,7 @@ jobs:
 
       - name: Send Slack notification
         if: steps.result.outputs.state == 'failure' || inputs.send-success-notification
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
           webhook: ${{ secrets.SLACK_PHP_BACKEND_CI_WEBHOOK_URL }}
           webhook-type: incoming-webhook
diff --git a/.github/workflows/browser-tests.yaml b/.github/workflows/browser-tests.yaml
index 8103284d9..8f1b4263e 100644
--- a/.github/workflows/browser-tests.yaml
+++ b/.github/workflows/browser-tests.yaml
@@ -3,7 +3,6 @@ name: Browser tests
 on:
     push:
         branches:
-            - main
             - '[0-9]+.[0-9]+'
     pull_request: ~
 
diff --git a/.github/workflows/frontend-ci.yaml b/.github/workflows/frontend-ci.yaml
index 109f8f802..be3a66f23 100644
--- a/.github/workflows/frontend-ci.yaml
+++ b/.github/workflows/frontend-ci.yaml
@@ -3,19 +3,18 @@ name: Frontend build
 on:
     push:
         branches:
-            - main
             - '[0-9]+.[0-9]+'
     pull_request: ~
 
 jobs:
     frontend-test:
         name: Frontend build test
-        runs-on: 'ubuntu-24.04'
+        runs-on: 'ubuntu-26.04'
         timeout-minutes: 5
 
         steps:
-            - uses: actions/checkout@v2
-            - uses: actions/setup-node@v2
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v7
               with:
                   node-version: '18'
             - run: yarn install
diff --git a/.github/workflows/pr-assign.yaml b/.github/workflows/pr-assign.yaml
deleted file mode 100644
index 302423e30..000000000
--- a/.github/workflows/pr-assign.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-name: Assign Pull Request to maintainers
-
-on:
-    pull_request_target:
-
-jobs:
-    assign:
-        uses: ibexa/gh-workflows/.github/workflows/pr-assign.yml@main
-        secrets:
-            robot-token: ${{ secrets.EZROBOT_PAT }}