diff --git a/.github/workflows/github-release.yaml b/.github/workflows/github-release.yaml
index ac26d66..3456d41 100644
--- a/.github/workflows/github-release.yaml
+++ b/.github/workflows/github-release.yaml
@@ -10,7 +10,7 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/.github/.github/workflows/bump-release.yaml@d5a29840172a53729c5999832534de65b7ba9587
+    uses: libops/.github/.github/workflows/bump-release.yaml@main
     with:
       workflow_file: goreleaser.yaml
     permissions:
diff --git a/.github/workflows/lint-test-build-push.yaml b/.github/workflows/lint-test-build-push.yaml
index 5ca9c48..2b29928 100644
--- a/.github/workflows/lint-test-build-push.yaml
+++ b/.github/workflows/lint-test-build-push.yaml
@@ -74,10 +74,14 @@ jobs:
     if: github.event_name == 'pull_request'
     strategy:
       matrix:
-        runner:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
+        architecture:
+          - runner: ubuntu-24.04
+            platform: linux/amd64
+            suffix: amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            suffix: arm64
+    runs-on: ${{ matrix.architecture.runner }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
@@ -85,31 +89,20 @@ jobs:
 
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
-      - name: Resolve native platform
-        id: platform
-        run: |
-          set -euo pipefail
-          case "$RUNNER_ARCH" in
-            X64) platform=amd64 ;;
-            ARM64) platform=arm64 ;;
-            *) echo "Unsupported runner architecture: $RUNNER_ARCH" >&2; exit 1 ;;
-          esac
-          echo "name=$platform" >> "$GITHUB_OUTPUT"
-
       - name: Build native image without credentials
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           load: true
-          platforms: linux/${{ steps.platform.outputs.name }}
+          platforms: ${{ matrix.architecture.platform }}
           provenance: false
           push: false
-          tags: vault-proxy:ci-${{ steps.platform.outputs.name }}
+          tags: vault-proxy:ci-${{ matrix.architecture.suffix }}
 
       - name: Scan native image
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: vault-proxy:ci-${{ steps.platform.outputs.name }}
+          image-ref: vault-proxy:ci-${{ matrix.architecture.suffix }}
           format: table
           exit-code: "1"
           ignore-unfixed: true
@@ -119,14 +112,13 @@ jobs:
   publish:
     if: github.event_name != 'pull_request'
     needs: [lint-test]
-    uses: libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587 # guarded-signed-image-publisher
+    uses: libops/.github/.github/workflows/build-push.yaml@main
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
       additional-gar-registry: us-docker.pkg.dev/libops-images/public
       scan: true
       sign: true
-      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
     permissions:
       contents: read
       packages: write
diff --git a/Dockerfile b/Dockerfile
index f55a3db..3f310e6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/libops/go:1.26.5@sha256:ea764e85e42a243217c621891123b3fda9374674c29d59785414fc6b15815b3d AS builder
+FROM ghcr.io/libops/go:1.26.6 AS builder
 
 WORKDIR /src
 
diff --git a/go.mod b/go.mod
index 6400b1c..7392c8c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module vault-proxy
 
-go 1.26.5
+go 1.26.6
 
 require gopkg.in/yaml.v3 v3.0.1
 
diff --git a/publication_contract_test.go b/publication_contract_test.go
deleted file mode 100644
index 65d92e3..0000000
--- a/publication_contract_test.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-const (
-	sharedPublisherSHA = "d5a29840172a53729c5999832534de65b7ba9587"
-	sharedWorkflowSHA  = "d5a29840172a53729c5999832534de65b7ba9587"
-)
-
-func readPublicationFile(t *testing.T, path string) string {
-	t.Helper()
-	content, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read %s: %v", path, err)
-	}
-	return string(content)
-}
-
-func TestPublicationUsesReviewedSharedWorkflows(t *testing.T) {
-	publisher := readPublicationFile(t, ".github/workflows/lint-test-build-push.yaml")
-	for _, required := range []string{
-		"libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
-		"additional-gar-registry: us-docker.pkg.dev/libops-images/public",
-		"expected-main-sha:",
-		"scan: true",
-		"sign: true",
-		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
-	} {
-		if !strings.Contains(publisher, required) {
-			t.Errorf("publisher workflow must contain %q", required)
-		}
-	}
-
-	release := readPublicationFile(t, ".github/workflows/github-release.yaml")
-	if !strings.Contains(release, "libops/.github/.github/workflows/bump-release.yaml@"+sharedWorkflowSHA) {
-		t.Fatal("release workflow must use the reviewed shared release workflow")
-	}
-	for _, forbidden := range []string{"build-push.yaml@main", "bump-release.yaml@main", "secrets: inherit"} {
-		if strings.Contains(publisher, forbidden) || strings.Contains(release, forbidden) {
-			t.Errorf("publication workflows must not contain %q", forbidden)
-		}
-	}
-
-	config := readPublicationFile(t, ".goreleaser.yml")
-	for _, required := range []string{"version: 2", "version_template:"} {
-		if !strings.Contains(config, required) {
-			t.Errorf("GoReleaser config must contain %q", required)
-		}
-	}
-}