diff --git a/.github/workflows/update-action-tag.yml b/.github/workflows/update-action-tag.yml
index d1519be..3dd4902 100644
--- a/.github/workflows/update-action-tag.yml
+++ b/.github/workflows/update-action-tag.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: true
 
       - name: Setup
-        uses: ./setup
+        uses: $/setup
         with:
           aws_role_arn: ${{ secrets.AWS_ROLE_ARN }}
           aws_region_name: ${{ vars.AWS_REGION_NAME }}
@@ -43,7 +43,7 @@ jobs:
           git push origin ":v${VERSION}" || true
 
       - name: Create a new signed tag
-        uses: ./git-sign
+        uses: $/git-sign
         with:
           command: git tag -a "v${{ env.VERSION }}" -m "Update tag" -s --local-user=${{ env.GPG_KEY_ID }}
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9c9846d..e978f2d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -21,4 +21,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
\ No newline at end of file
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
\ No newline at end of file
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 253e6a7..e8f4212 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,5 +28,8 @@ pre-commit run --all-files --hook-stage manual shellcheck
 
 To bump the version tag, run the "Update Tag" [workflow](https://github.com/mongodb-labs/drivers-github-tools/actions/workflows/update-action-tag.yml).
 
-To change the major version, update `.github/workflows/version.txt` and all references to `mongodb-labs/drivers-github-tools`
-in the repo.
\ No newline at end of file
+To change the major version, update `.github/workflows/version.txt`. Internal
+action-to-action references use `$/` and do not need updating on a version bump.
+Update the example `mongodb-labs/drivers-github-tools/...@vX` references in
+`README.md` and `node/release_template.yml`, both of which document or use the
+tag external consumers should pin to.
\ No newline at end of file
diff --git a/README.md b/README.md
index d23f9c1..32a5a79 100644
--- a/README.md
+++ b/README.md
@@ -9,10 +9,17 @@ See the [How To: Set up Secure Release Process using GitHub Action](https://wiki
 
 ## Working on Actions
 
-Many of the actions in this repo depend on one another.  There is no supported way to reference
-another action using a relative path.  Therefore the recommended approach is to
-set all of the relative actions to your branch name while working on a feature,
-then reverting to the version tag before merging.
+Many of the actions in this repo depend on one another. Internal action-to-action
+references use GitHub Actions' `$/` self-repository syntax (e.g. `uses: $/setup`),
+which resolves to the repository and ref of the file containing the reference:
+this repo, at the exact commit running, for anything that executes here. No
+version pin or checkout is needed. Use `$/` for any new internal reference
+instead of a pinned `mongodb-labs/drivers-github-tools/...@v3` reference.
+
+The one exception is `node/release_template.yml`: it's a template that
+`node/generate_release.mjs` renders into Node.js driver repos as their own
+release workflow, so `$/` there would resolve to the driver repo instead of
+this one. It must keep pinned `owner/repo/path@vX` references.
 
 ## Consuming Actions
 
@@ -20,6 +27,13 @@ It is recommended that you use Dependabot and use an explicit reference when
 using these actions.  This will allow Dependabot to update to a more recent sha
 and allow you to accept updates to the actions as needed.
 
+Because `$/` resolves relative to the pinned ref (see "Working on Actions"
+above), pinning an old sha of a top-level action also freezes the sub-actions
+it calls internally at that same point, rather than always picking up their
+latest tagged version. For example, pinning `full-report` to an old sha means
+it also calls that old sha's `sbom`, `authorized-pub`, `code-scanning-export`,
+and `compliance-report`. Bump your pin to pick up sub-action updates too.
+
 Example `dependabot.yml`:
 
 ```yaml
diff --git a/bump-version/action.yml b/bump-version/action.yml
index eb591c5..2378cb9 100644
--- a/bump-version/action.yml
+++ b/bump-version/action.yml
@@ -36,7 +36,7 @@ runs:
         export COMMIT_MESSAGE=$(echo "${{ inputs.commit_template }}" | envsubst)
         echo "COMMIT_MESSAGE=$COMMIT_MESSAGE" >> $GITHUB_ENV
     - name: Commit the version bump
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git commit -a -m "${{ env.COMMIT_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --gpg-sign=${{ env.GPG_KEY_ID }}
diff --git a/create-branch/action.yml b/create-branch/action.yml
index 45c2c79..b1b1502 100644
--- a/create-branch/action.yml
+++ b/create-branch/action.yml
@@ -39,7 +39,7 @@ runs:
         RELEASE_WORKFLOW_PATH: ${{ inputs.release_workflow_path }}
         EVERGREEN_PROJECT: ${{ inputs.evergreen_project }}
       run: ${{ github.action_path }}/create-branch.sh
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: ${{ inputs.version_bump_script }}
diff --git a/full-report/action.yml b/full-report/action.yml
index 1c2e244..179b5e8 100644
--- a/full-report/action.yml
+++ b/full-report/action.yml
@@ -36,7 +36,7 @@ runs:
   using: composite
   steps:
     - name: Generate Authorized Publication Report
-      uses: mongodb-labs/drivers-github-tools/authorized-pub@v3
+      uses: $/authorized-pub
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ inputs.release_version }}
@@ -45,18 +45,18 @@ runs:
     - name: Generate SBOM File
       # not all packages have third party dependencies, and so not all packages produce sboms.
       if: ${{ inputs.sbom_in_path }}
-      uses: mongodb-labs/drivers-github-tools/sbom@v3
+      uses: $/sbom
       with:
         sbom_file_name: ${{ inputs.sbom_file_name }}
         kondukto_sub_project: ${{ inputs.kondukto_sub_project }}
         sbom_in_path: ${{ inputs.sbom_in_path }}
     - name: Generate Sarif File
-      uses: mongodb-labs/drivers-github-tools/code-scanning-export@v3
+      uses: $/code-scanning-export
       with:
         ref: ${{ inputs.sarif_report_target_ref || inputs.release_version }}
         output-file: ${{ env.S3_ASSETS }}/code-scanning-alerts.json
     - name: Generate Compliance Report
-      uses: mongodb-labs/drivers-github-tools/compliance-report@v3
+      uses: $/compliance-report
       with:
         release_version: ${{ inputs.release_version }}
         security_report_location: ${{ inputs.security_report_location }}
diff --git a/golang/pre-publish/action.yml b/golang/pre-publish/action.yml
index 0b55278..5309936 100644
--- a/golang/pre-publish/action.yml
+++ b/golang/pre-publish/action.yml
@@ -17,14 +17,14 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: mongodb-labs/drivers-github-tools/bump-version@v3
+    - uses: $/bump-version
       with:
         version: ${{ inputs.version }}
         version_bump_script: "go run ${{ github.action_path }}/bump-version.go"
         commit_template: "BUMP v${VERSION}"
         # Never push commit, we still need to merge up if a push is requested
         push_commit: false
-    - uses: mongodb-labs/drivers-github-tools/tag-version@v3
+    - uses: $/tag-version
       with:
         version: v${{ inputs.version }}
         push_tag: ${{ inputs.push_changes }}
diff --git a/golang/publish/action.yml b/golang/publish/action.yml
index a942f02..69d3ed2 100644
--- a/golang/publish/action.yml
+++ b/golang/publish/action.yml
@@ -24,7 +24,7 @@ runs:
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: mongo-go-driver
         release_version: ${{ inputs.version }}
@@ -43,7 +43,7 @@ runs:
         GH_TOKEN: ${{ inputs.token }}
       run: ./publish.sh
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
           version: ${{ inputs.version }}
           product_name: mongo-go-driver
diff --git a/node/generate_release.mjs b/node/generate_release.mjs
index 7246f97..fa98c0d 100644
--- a/node/generate_release.mjs
+++ b/node/generate_release.mjs
@@ -19,7 +19,10 @@ const isNative =
 const template = readFileSync(
   join(__dirname, "./release_template.yml"),
   "utf-8",
-);
+)
+  .split("\n")
+  .filter((line) => !line.startsWith("# This is a template rendered into"))
+  .join("\n");
 
 const EVERGREEN_PROJECTS = {
   mongodb: "mongo-node-driver-next",
diff --git a/node/release_template.yml b/node/release_template.yml
index 03c5fbe..4e2293e 100644
--- a/node/release_template.yml
+++ b/node/release_template.yml
@@ -1,3 +1,4 @@
+# This is a template rendered into Node.js driver repos by generate_release.mjs, so it must keep pinned owner/repo/path@vX references (not $/), since $/ resolves relative to whatever repo the rendered workflow ends up living in, not this repo.
 on:
   push:
     branches: [RELEASE_BRANCH]
diff --git a/node/sign_node_package/action.yml b/node/sign_node_package/action.yml
index 585d3c2..9cc66db 100644
--- a/node/sign_node_package/action.yml
+++ b/node/sign_node_package/action.yml
@@ -42,12 +42,12 @@ runs:
         mkdir ${{ inputs.artifact_directory }}
 
     - name: Load version and package info
-      uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
+      uses: $/node/get_version_info
       with:
         npm_package_name: ${{ inputs.npm_package_name }}
 
     - name: Set up drivers-github-tools
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_region_name: ${{ inputs.aws_region_name }}
         aws_role_arn: ${{ inputs.aws_role_arn }}
@@ -70,7 +70,7 @@ runs:
         echo "FILES_TO_SIGN=${FILENAMES}" >> "$GITHUB_ENV"
 
     - name: Create detached signature
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: ${{ env.FILES_TO_SIGN }}
       env:
diff --git a/python-labs/post-publish/action.yml b/python-labs/post-publish/action.yml
index 3721594..1ab2881 100644
--- a/python-labs/post-publish/action.yml
+++ b/python-labs/post-publish/action.yml
@@ -73,7 +73,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}
diff --git a/python-labs/pre-publish/action.yml b/python-labs/pre-publish/action.yml
index b3e0cda..2eb31a1 100644
--- a/python-labs/pre-publish/action.yml
+++ b/python-labs/pre-publish/action.yml
@@ -55,7 +55,7 @@ runs:
         echo "VERSION=$VERSION" >> $GITHUB_ENV
         rm -rf dist
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}
diff --git a/python/post-publish/action.yml b/python/post-publish/action.yml
index 191b87b..f542271 100644
--- a/python/post-publish/action.yml
+++ b/python/post-publish/action.yml
@@ -70,7 +70,7 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Create detached signature for dist files
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: dist/*
     - name: Get the evergreen commit
@@ -78,7 +78,7 @@ runs:
       shell: bash
       run: |
         echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
-    - uses: mongodb-labs/drivers-github-tools/full-report@v3
+    - uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ env.VERSION }}
@@ -89,7 +89,7 @@ runs:
         evergreen_project: ${{ inputs.evergreen_project }}
         evergreen_commit: ${{ steps.evergreen-commit.outputs.commit }}
         token: ${{ inputs.token }}
-    - uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+    - uses: $/upload-s3-assets
       with:
           version: ${{ env.VERSION }}
           product_name: ${{ inputs.product_name }}
@@ -124,7 +124,7 @@ runs:
         git clean -dffx
         git pull origin ${GITHUB_REF}
     - name: Set following version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: inputs.dry_run == 'false'
       with:
           version: ${{ steps.publish-script.outputs.following_version }}
diff --git a/python/pre-publish/action.yml b/python/pre-publish/action.yml
index 5ffde7b..a16cc97 100644
--- a/python/pre-publish/action.yml
+++ b/python/pre-publish/action.yml
@@ -65,7 +65,7 @@ runs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         fi
     - name: Set version
-      uses: mongodb-labs/drivers-github-tools/bump-version@v3
+      uses: $/bump-version
       if: ${{ inputs.version }}
       with:
         version: ${{ env.VERSION }}
@@ -73,7 +73,7 @@ runs:
         working_directory: ${{ inputs.working_directory }}
         push_commit: ${{ env.PUSH_CHANGES }}
     - name: Tag version
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       with:
         version: ${{ env.VERSION }}
         tag_template: ${{ inputs.tag_template }}
diff --git a/ruby/build/action.yml b/ruby/build/action.yml
index 3c81c0c..a124f26 100644
--- a/ruby/build/action.yml
+++ b/ruby/build/action.yml
@@ -34,7 +34,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
diff --git a/ruby/cleanup/action.yml b/ruby/cleanup/action.yml
index e6801f1..9a81aa0 100644
--- a/ruby/cleanup/action.yml
+++ b/ruby/cleanup/action.yml
@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: 'Check out the repository'
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
diff --git a/ruby/publish/action.yml b/ruby/publish/action.yml
index 87ddc53..a973127 100644
--- a/ruby/publish/action.yml
+++ b/ruby/publish/action.yml
@@ -57,7 +57,7 @@ runs:
   using: composite
   steps:
     - name: Check out the repository
-      uses: mongodb-labs/drivers-github-tools/secure-checkout@v3
+      uses: $/secure-checkout
       with:
         app_id: ${{ inputs.app_id }}
         private_key: ${{ inputs.app_private_key }}
@@ -80,7 +80,7 @@ runs:
       run: echo "version=$(bundle exec rake version)" >> "$GITHUB_OUTPUT"
 
     - name: Setup GitHub tooling for DBX Drivers
-      uses: mongodb-labs/drivers-github-tools/setup@v3
+      uses: $/setup
       with:
         aws_role_arn: ${{ inputs.aws_role_arn }}
         aws_region_name: ${{ inputs.aws_region_name }}
@@ -94,12 +94,12 @@ runs:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Sign the gems
-      uses: mongodb-labs/drivers-github-tools/gpg-sign@v3
+      uses: $/gpg-sign
       with:
         filenames: '*.gem'
 
     - name: Generate SSDLC Reports
-      uses: mongodb-labs/drivers-github-tools/full-report@v3
+      uses: $/full-report
       with:
         product_name: ${{ inputs.product_name }}
         release_version: ${{ steps.release_version.outputs.version }}
@@ -122,7 +122,7 @@ runs:
         fi
 
     - name: Create the tag
-      uses: mongodb-labs/drivers-github-tools/tag-version@v3
+      uses: $/tag-version
       if: steps.tag_exists.outputs.exists == 'false'
       with:
         version: ${{ steps.release_version.outputs.version }}
@@ -176,7 +176,7 @@ runs:
       run: gh release upload --clobber v${RELEASE_VERSION} *.gem ${RELEASE_ASSETS}/*.sig
 
     - name: Upload S3 assets
-      uses: mongodb-labs/drivers-github-tools/upload-s3-assets@v3
+      uses: $/upload-s3-assets
       with:
         version: ${{ steps.release_version.outputs.version }}
         product_name: ${{ inputs.product_id }}
diff --git a/tag-version/action.yml b/tag-version/action.yml
index fa3df7f..89e9ef1 100644
--- a/tag-version/action.yml
+++ b/tag-version/action.yml
@@ -33,7 +33,7 @@ runs:
         export TAG_MESSAGE=$(echo "${{ inputs.tag_message_template }}" | envsubst)
         echo "TAG_MESSAGE=$TAG_MESSAGE" >> $GITHUB_ENV
     - name: Tag the version
-      uses: mongodb-labs/drivers-github-tools/git-sign@v3
+      uses: $/git-sign
       with:
         command: |-
           git tag -a "${{ env.TAG }}" -m "${{ env.TAG_MESSAGE }}" ${{ env.GPG_PUBLIC_URL != '' && format('-m "PGP-Signing-Key: {0}"', env.GPG_PUBLIC_URL) || '' }} -s --local-user=${{ env.GPG_KEY_ID }}