diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 4655a91b..4de04532 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -11,5 +11,5 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index 1ce5dc3d..1a17272e 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -31,7 +31,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       bump-type: ${{ inputs.bump-type }}
       tag-message-title: ${{ inputs.tag-message-title }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 251010bd..56544e66 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,5 +18,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 2f6b71d5..3e4dea3a 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -14,5 +14,5 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit
diff --git a/.github/workflows/front-end-test.yml b/.github/workflows/front-end-test.yml
index 49ee762c..81e4ec53 100644
--- a/.github/workflows/front-end-test.yml
+++ b/.github/workflows/front-end-test.yml
@@ -40,7 +40,7 @@ jobs:
       # A called workflow cannot hold more than its caller grants, and an omitted scope
       # is 'none': without this the run is rejected before it starts.
       pull-requests: read
-    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       preset: front-end
       # The producer of the -format=json envelope the app consumes. A change here can
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index 89ca2b48..d775e868 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   test:
-    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       # The suites emit the same document under any loader -- TestLoaderAgreement holds that over
       # the whole corpus -- so which one runs is a question about what the run costs, and this
diff --git a/.github/workflows/monitor-bot-pr.yml b/.github/workflows/monitor-bot-pr.yml
index e72907b8..e0e8965b 100644
--- a/.github/workflows/monitor-bot-pr.yml
+++ b/.github/workflows/monitor-bot-pr.yml
@@ -15,5 +15,5 @@ jobs:
       contents: write
       pull-requests: write
       statuses: read
-    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit
diff --git a/.github/workflows/scanner.yml b/.github/workflows/scanner.yml
index 6c39433e..860c713b 100644
--- a/.github/workflows/scanner.yml
+++ b/.github/workflows/scanner.yml
@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     secrets: inherit
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index cc5d448e..9f185e9f 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -13,7 +13,7 @@ jobs:
     name: Create release
     permissions:
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/release.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/release.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       tag: ${{ github.ref_name }}
       is-monorepo: 'true'
diff --git a/.github/workflows/update-doc.yml b/.github/workflows/update-doc.yml
index 1b3874d5..aadde70a 100644
--- a/.github/workflows/update-doc.yml
+++ b/.github/workflows/update-doc.yml
@@ -37,7 +37,7 @@ jobs:
       # A called workflow cannot hold more than its caller grants, and an omitted scope
       # is 'none': without this the run is rejected before it starts.
       pull-requests: read
-    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/changed-paths.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       preset: doc
       # The preset knows the go-openapi layout — markdown anywhere, the hugo tree under
diff --git a/.github/workflows/webhook-announcements.yml b/.github/workflows/webhook-announcements.yml
index 642cc860..3d661a21 100644
--- a/.github/workflows/webhook-announcements.yml
+++ b/.github/workflows/webhook-announcements.yml
@@ -50,7 +50,7 @@ on:
 
 jobs:
   announce:
-    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@cba06a2e6390abfedda6bf1067f44741cbe93650 # v0.6.2
+    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@69a76bc5d13145693ca13d24a418942b59fce727 # v0.6.3
     with:
       scanned-markdown: README.md
       # On push: normal before..after diff (empty