diff --git a/.github/workflows/auto-close.yml b/.github/workflows/auto-close.yml
index fd49954..597ef77 100644
--- a/.github/workflows/auto-close.yml
+++ b/.github/workflows/auto-close.yml
@@ -24,7 +24,7 @@ jobs:
   auto-close:
     permissions:
       issues: write  # label, comment on, and close resolved issues
-    uses: whuppi/ci/.github/workflows/auto-close.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/auto-close.yml@v2.4.0
     with:
       # Team slug, not a hardcoded person — membership is managed in the org
       # (the same team CODEOWNERS uses), so a maintainer change never edits this.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ac89f4..2252b86 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: analyze
 
@@ -96,7 +96,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: analyze-floor
 
@@ -112,7 +112,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: platforms
 
@@ -128,7 +128,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: test-guards
 
@@ -144,7 +144,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: test
 
@@ -160,7 +160,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: test-web
           chrome: 'true'
@@ -178,7 +178,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         with:
           make-target: test-example
 
diff --git a/.github/workflows/debug-ssh.yml b/.github/workflows/debug-ssh.yml
index e0ef54a..17eeab2 100644
--- a/.github/workflows/debug-ssh.yml
+++ b/.github/workflows/debug-ssh.yml
@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: whuppi/ci/actions/debug-ssh@v2.0.5
+      - uses: whuppi/ci/actions/debug-ssh@v2.4.0
 
       - name: Keep alive (touch /tmp/stop to end)
         shell: bash
diff --git a/.github/workflows/full-test.yml b/.github/workflows/full-test.yml
index e0cdc44..7d88ecc 100644
--- a/.github/workflows/full-test.yml
+++ b/.github/workflows/full-test.yml
@@ -95,7 +95,7 @@ jobs:
     steps:
       - name: Check filter
         id: filter
-        uses: whuppi/ci/actions/matrix-filter@v2.0.5
+        uses: whuppi/ci/actions/matrix-filter@v2.4.0
         with:
           name: ${{ matrix.name }}
           filter: ${{ needs.inputs.outputs.filter }}
@@ -105,7 +105,7 @@ jobs:
         if: steps.filter.outputs.match == 'true'
         with:
           persist-credentials: false
-      - uses: whuppi/ci/actions/make-target@v2.0.5
+      - uses: whuppi/ci/actions/make-target@v2.4.0
         if: steps.filter.outputs.match == 'true'
         with:
           make-target: ${{ matrix.make }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 6f04cbe..a79944d 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -23,4 +23,4 @@ jobs:
     permissions:
       contents: read  # checkout reads .github/labels.json
       issues: write   # labels are managed through the Issues API
-    uses: whuppi/ci/.github/workflows/labels.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/labels.yml@v2.4.0
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index deffd06..9c3d940 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -20,4 +20,4 @@ jobs:
   checks:
     permissions:
       contents: read  # the reusable jobs only checkout + lint, read-only
-    uses: whuppi/ci/.github/workflows/pr-checks.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/pr-checks.yml@v2.4.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 790d762..71dacbc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
   release:
     permissions:
       contents: write  # create the release/tag, edit notes, ephemeral publish commit
-    uses: whuppi/ci/.github/workflows/release.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/release.yml@v2.4.0
     with:
       branch: ${{ inputs.branch || github.ref_name }}
       runner: ${{ inputs.runner || 'ubuntu-24.04' }}
diff --git a/.github/workflows/retry.yml b/.github/workflows/retry.yml
index 064a4e0..5592cf2 100644
--- a/.github/workflows/retry.yml
+++ b/.github/workflows/retry.yml
@@ -27,4 +27,4 @@ jobs:
   retry:
     permissions:
       actions: write  # gh run rerun re-runs the failed jobs of the run
-    uses: whuppi/ci/.github/workflows/retry.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/retry.yml@v2.4.0
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 2ce9b7f..eee7c20 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -29,4 +29,4 @@ jobs:
       contents: read        # labeler reads .github/labeler.yml + the PR file list
       issues: write         # assign maintainer on issue-opened events
       pull-requests: write  # apply labels, revoke ready-to-test, post notices
-    uses: whuppi/ci/.github/workflows/triage.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/triage.yml@v2.4.0
diff --git a/.github/workflows/upgrade-check.yml b/.github/workflows/upgrade-check.yml
index 1f64e2e..8bb2268 100644
--- a/.github/workflows/upgrade-check.yml
+++ b/.github/workflows/upgrade-check.yml
@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write       # pushes the chore/flutter-sdk + chore/lockfiles branches
       pull-requests: write  # opens / edits the upgrade PRs
-    uses: whuppi/ci/.github/workflows/upgrade-check.yml@v2.0.5
+    uses: whuppi/ci/.github/workflows/upgrade-check.yml@v2.4.0
     with:
       branch: dev