diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 70dcf28..3277a95 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -16,6 +16,7 @@
 name: Dependabot Auto-Merge
 
 on:
+  # zizmor: ignore[dangerous-triggers] Safe here: zero code checkout, author strictly verified as dependabot[bot], and metadata only gates auto-merge
   pull_request_target:
     types: [opened, synchronize, reopened]
 
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
index bea2bb5..748d886 100644
--- a/.github/workflows/issue-labeler.yml
+++ b/.github/workflows/issue-labeler.yml
@@ -16,14 +16,14 @@ permissions:
   contents: read
   issues: write
 
-concurrency:
-  group: issue-metadata-${{ github.event.issue.number }}
-  cancel-in-progress: true
-
 jobs:
   triage:
     name: triage
     runs-on: ubuntu-latest
+    if: github.event.issue != null
+    concurrency:
+      group: issue-metadata-${{ github.event.issue.number }}
+      cancel-in-progress: true
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Classify, label, and assign issue
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         env:
           GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
         with:
diff --git a/.github/workflows/pr-metadata.yml b/.github/workflows/pr-metadata.yml
index a34a5b7..51d1252 100644
--- a/.github/workflows/pr-metadata.yml
+++ b/.github/workflows/pr-metadata.yml
@@ -35,7 +35,7 @@ on:
     types: [completed]
 
 permissions:
-  contents: read
+  contents: write
   pull-requests: write
   checks: read
 
@@ -55,7 +55,7 @@ jobs:
       (github.event.check_suite.pull_requests[0] != null && github.event.check_suite.head_branch != 'main')
     steps:
       - name: Classify and update PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const SIZE_LABELS = ['size:XS', 'size:S', 'size:M', 'size:L', 'size:XL'];
diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml
index fe94dc6..652519e 100644
--- a/.github/workflows/pull_request_label.yml
+++ b/.github/workflows/pull_request_label.yml
@@ -26,9 +26,9 @@ jobs:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true
 
-      - name: Auto-trigger Sourcery review on PR update
-        if: github.event.action == 'synchronize'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0
+      - name: Auto-trigger AI reviews on PR update
+        if: github.event.action == 'opened' || github.event.action == 'synchronize'
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
           script: |
@@ -36,6 +36,6 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.payload.pull_request.number,
-              body: '@sourcery-ai review',
+              body: '@sourcery-ai review\n@coderabbitai review',
             });
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b7170e5..652e1a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
 
     # Wait for this SHA's 'validate' check to finish successfully before publishing
     - name: Wait for validate check
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
         script: |
           const targetSha = '${{ github.sha }}';