diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 90eb0aa8..f411c52b 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -1,28 +1,133 @@
-name: Spellcheck PR Diff
+name: Check Spelling
+
+# Comment management is handled through a secondary job, for details see:
+# https://github.com/check-spelling/check-spelling/wiki/Feature%3A-Restricted-Permissions
+#
+# `jobs.comment-push` runs when a push is made to a repository and the `jobs.spelling` job needs to make a comment
+#   (in odd cases, it might actually run just to collapse a comment, but that's fairly rare)
+#   it needs `contents: write` in order to add a comment.
+#
+# `jobs.comment-pr` runs when a pull_request is made to a repository and the `jobs.spelling` job needs to make a comment
+#   or collapse a comment (in the case where it had previously made a comment and now no longer needs to show a comment)
+#   it needs `pull-requests: write` in order to manipulate those comments.
+
+# Updating pull request branches is managed via comment handling.
+# For details, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-expect-list
+#
+# These elements work together to make it happen:
+#
+# `on.issue_comment`
+#   This event listens to comments by users asking to update the metadata.
+#
+# `jobs.update`
+#   This job runs in response to an issue_comment and will push a new commit
+#   to update the spelling metadata.
+#
+# `with.experimental_apply_changes_via_bot`
+#   Tells the action to support and generate messages that enable it
+#   to make a commit to update the spelling metadata.
+#
+# `with.ssh_key`
+#   In order to trigger workflows when the commit is made, you can provide a
+#   secret (typically, a write-enabled github deploy key).
+#
+#   For background, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-with-deploy-key
+
+# Sarif reporting
+#
+# Access to Sarif reports is generally restricted (by GitHub) to members of the repository.
+#
+# Requires enabling `security-events: write`
+# and configuring the action with `use_sarif: 1`
+#
+#   For information on the feature, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Sarif-output
+
+# Minimal workflow structure:
+#
+# on:
+#   push:
+#     ...
+#   pull_request_target:
+#     ...
+# jobs:
+#   # you only want the spelling job, all others should be omitted
+#   spelling:
+#     # remove `security-events: write` and `use_sarif: 1`
+#     # remove `experimental_apply_changes_via_bot: 1`
+#     ... otherwise adjust the `with:` as you wish
 
 on:
   pull_request:
     branches:
-      - master
+      - "**"
 
 jobs:
-  spellcheck:
-    name: Spellcheck PR Diff
+  spelling:
+    name: Check Spelling
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    outputs:
+      followup: ${{ steps.spelling.outputs.followup }}
     runs-on: ubuntu-latest
+    # if on repo to avoid failing runs on forks
+    if: |
+      github.repository == 'compiler-research/compiler-research.github.io'
+        && (contains(github.event_name, 'pull_request'))
+    concurrency:
+      group: spelling-${{ github.event.pull_request.number || github.ref }}
+      # note: If you use only_check_changed_files, you do not want cancel-in-progress
+      cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v4
-      - name: Install aspell
-        run: |
-          sudo apt-get install -y aspell aspell-en
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: 3.11
-      - uses: compiler-research/git-spell-check@master
+      - name: check-spelling
+        id: spelling
+        uses: check-spelling/check-spelling@main
         with:
-          debug: 1
-      - name: Setup tmate session
-        if: ${{ !cancelled() && runner.debug }}
-        uses: mxschmitt/action-tmate@v3
-        # When debugging increase to a suitable value!
-        timeout-minutes: 30
+          suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
+          checkout: true
+          check_file_names: 1
+          spell_check_this: check-spelling/spell-check-this@main
+          post_comment: 0
+          use_magic_file: 1
+          report-timing: 1
+          warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check,unclosed-block-ignore-begin,unclosed-block-ignore-end
+          experimental_apply_changes_via_bot: 1
+          only_check_changed_files: true
+          check_extra_dictionaries: ''
+          dictionary_source_prefixes: '{"cspell": "https://raw.githubusercontent.com/streetsidesoftware/cspell-dicts/main/dictionaries/"}'
+          extra_dictionaries: |
+            cspell:aws/dict/aws.txt
+            cspell:bash/samples/bash-words.txt
+            cspell:companies/dict/companies.txt
+            cspell:css/dict/css.txt
+            cspell:data-science/dict/data-science-models.txt
+            cspell:data-science/dict/data-science.txt
+            cspell:data-science/dict/data-science-tools.txt
+            cspell:en_shared/dict/acronyms.txt
+            cspell:en_shared/dict/shared-additional-words.txt
+            cspell:en_GB/en_GB.trie
+            cspell:en_US/en_US.trie
+            cspell:filetypes/src/filetypes.txt
+            cspell:fonts/dict/fonts.txt
+            cspell:fullstack/dict/fullstack.txt
+            cspell:golang/dict/go.txt
+            cspell:google/dict/google.txt
+            cspell:html/dict/html.txt
+            cspell:java/src/java.txt
+            cspell:k8s/dict/k8s.txt
+            cspell:mnemonics/dict/mnemonics.txt
+            cspell:monkeyc/src/monkeyc_keywords.txt
+            cspell:node/dict/node.txt
+            cspell:npm/dict/npm.txt
+            cspell:people-names/dict/people-names.txt
+            cspell:python/dict/python.txt
+            cspell:python/dict/python-common.txt
+            cspell:shell/dict/shell-all-words.txt
+            cspell:software-terms/dict/softwareTerms.txt
+            cspell:software-terms/dict/webServices.txt
+            cspell:sql/src/common-terms.txt
+            cspell:sql/src/sql.txt
+            cspell:sql/src/tsql.txt
+            cspell:terraform/dict/terraform.txt
+            cspell:typescript/dict/typescript.txt