diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a06eafc..c8ed4ce 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,47 +1,18 @@
-name: Build & Test
+name: Go CI
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
   workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: read-all
 
 jobs:
   build:
-    name: 🧩 Build & Test
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: 'go.mod'
-          cache: true
-
-      - name: Install Dependencies
-        run: go mod download
-
-      - name: Build
-        run: |
-          go version
-          go build -o bin/sbom-validator-example example/main.go
-
-      - name: Run Tests
-        run: |
-          go test -v -coverprofile=coverage.out ./...
-          go tool cover -func=coverage.out
-
-      - name: Upload Coverage Report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: coverage-report
-          path: coverage.out
-
-      - name: Add Job Summary
-        run: |
-          echo "### ✅ Build & Test Completed" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Unit tests passed successfully" >> $GITHUB_STEP_SUMMARY
-          echo "- 📊 Coverage Summary:" >> $GITHUB_STEP_SUMMARY
-          go tool cover -func=coverage.out | tail -n 1 >> $GITHUB_STEP_SUMMARY
+    uses: shiftleftcyber/supply-chain-workflows/.github/workflows/go-ci.yml@08214ced07c278eaed1c68fa459916e07f071553
+    with:
+      coverage-artifact-name: coverage-report
+      go-version-file: go.mod
+      working-directory: .
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index 09c8a21..0000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches:
-    - main
-  pull_request:
-    branches:
-    - main
-  workflow_dispatch: { }
-  schedule:
-    - cron: "42 23 * * 5"   # run friday night
-
-permissions: { }
-
-jobs:
-  analyze:
-    name: Analyze
-    timeout-minutes: 10
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # tag=v4.3.1
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2
-      with:
-        languages: "go"
-    - name: Run Autobuild
-      uses: github/codeql-action/autobuild@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2
-    - name: Perform Analysis
-      uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2
\ No newline at end of file
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f5af221..309dd82 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,35 +1,18 @@
-name: golangci-lint
+name: Go Lint
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
   workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   lint:
-    name: 🔍 Lint
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: 'go.mod'
-          cache: true
-
-      - name: Install Dependencies
-        run: go mod download
-
-      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
-        with:
-          version: v2.8
-
-      - name: Add Job Summary
-        run: |
-          echo "### 🔍 Lint Results" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Code linting completed successfully" >> $GITHUB_STEP_SUMMARY
+    uses: shiftleftcyber/supply-chain-workflows/.github/workflows/go-lint.yml@08214ced07c278eaed1c68fa459916e07f071553
+    with:
+      go-version-file: go.mod
+      golangci-lint-version: v2.8.0
+      working-directory: .
diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml
deleted file mode 100644
index 0fee8e1..0000000
--- a/.github/workflows/osv-scanner-pr.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: OSV-Scanner PR Scan
-
-on:
-  pull_request:
-    branches: [main]
-  merge_group:
-    branches: [main]
-
-permissions:
-  actions: read
-  security-events: write
-  contents: read
-
-jobs:
-  scan-pr:
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" #v2.3.8
diff --git a/.github/workflows/osv-scanner-schedule.yml b/.github/workflows/osv-scanner-schedule.yml
deleted file mode 100644
index 57f8cdb..0000000
--- a/.github/workflows/osv-scanner-schedule.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: OSV-Scanner Scan
-
-on:
-  schedule:
-    - cron: "30 12 * * 1"
-
-permissions:
-  actions: read
-  security-events: write
-  contents: read
-
-jobs:
-  scan-scheduled:
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" #v2.3.8
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..ed25274
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,21 @@
+name: Go Security
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "30 12 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  security:
+    uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@d175f38df5c7934cadbc5a9024d21bce9ac55530
+    with:
+      go-version-file: go.mod
+      working-directory: .
diff --git a/go.mod b/go.mod
index 2bec88c..462aaa3 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/shiftleftcyber/sbom-validator/v2
 
-go 1.25.7
+go 1.25.13
 
 require github.com/xeipuuv/gojsonschema v1.2.0