diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index 0dc22fd..894426a 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -1,17 +1,3 @@
-# Copyright 2024 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 name: 'Draft release'
 
 on:
@@ -29,10 +15,8 @@ on:
 
 jobs:
   draft-release:
-    name: 'Draft release'
-    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v0'
+    uses: 'google-github-actions/.github/.github/workflows/draft-release.yml@v3' # ratchet:exclude
     with:
       version_strategy: '${{ github.event.inputs.version_strategy }}'
-    # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow
     secrets:
       ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index fb49f8d..491a9dc 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -38,33 +38,33 @@ jobs:
     if: ${{ github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name && github.actor != 'dependabot[bot]' }}
     runs-on: 'ubuntu-latest'
     steps:
-    - uses: 'actions/checkout@v4'
+      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
 
-    - uses: 'google-github-actions/auth@v2'
-      with:
-        workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
+      - uses: 'google-github-actions/auth@v2' # ratchet:exclude
+        with:
+          workload_identity_provider: '${{ vars.WIF_PROVIDER_NAME }}'
 
-    # The existing gke-deploy CLI will succeed or fail with logs with troubleshooting logs
-    # Please refer to https://github.com/GoogleCloudPlatform/cloud-builders/tree/master/gke-deploy
-    # for more information.
-    - name: 'deploy-gke'
-      uses: './'
-      with:
-        image: '${{ vars.IMAGE }}'
-        app_name: '${{ vars.APP_NAME }}'
-        region: '${{ vars.CLUSTER_REGION }}'
-        cluster_name: '${{ vars.CLUSTER_NAME }}'
-        project_id: '${{ vars.PROJECT_ID }}'
-        namespace: '${{ vars.NAMESPACE }}'
+      # The existing gke-deploy CLI will succeed or fail with logs with troubleshooting logs
+      # Please refer to https://github.com/GoogleCloudPlatform/cloud-builders/tree/master/gke-deploy
+      # for more information.
+      - name: 'deploy-gke'
+        uses: './'
+        with:
+          image: '${{ vars.IMAGE }}'
+          app_name: '${{ vars.APP_NAME }}'
+          region: '${{ vars.CLUSTER_REGION }}'
+          cluster_name: '${{ vars.CLUSTER_NAME }}'
+          project_id: '${{ vars.PROJECT_ID }}'
+          namespace: '${{ vars.NAMESPACE }}'
 
-    - name: 'get credentials'
-      uses: 'google-github-actions/get-gke-credentials@v2'
-      with:
-        cluster_name: '${{ vars.CLUSTER_NAME }}'
-        location: '${{ vars.CLUSTER_REGION }}'
-        project_id: '${{ vars.PROJECT_ID }}'
+      - name: 'get credentials'
+        uses: 'google-github-actions/get-gke-credentials@v2' # ratchet:exclude
+        with:
+          cluster_name: '${{ vars.CLUSTER_NAME }}'
+          location: '${{ vars.CLUSTER_REGION }}'
+          project_id: '${{ vars.PROJECT_ID }}'
 
-    - name: 'get-deployment'
-      shell: bash
-      run: |
-        kubectl get deployment -n ${{ vars.NAMESPACE }}
+      - name: 'get-deployment'
+        shell: bash
+        run: |
+          kubectl get deployment -n ${{ vars.NAMESPACE }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 64566b6..afe9503 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: 'actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871' # ratchet:actions/checkout@v4
+        uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4
 
       - name: 'Publish'
         id: 'publish'
-        uses: 'actions/publish-immutable-action@4b1aa5c1cde5fedc80d52746c9546cb5560e5f53' # ratchet:actions/publish-immutable-action@v0.0.3
+        uses: 'actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978' # ratchet:actions/publish-immutable-action@v0.0.4
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 747b701..0457b00 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,17 +1,3 @@
-# Copyright 2024 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
 name: 'Release'
 
 on:
@@ -22,10 +8,6 @@ on:
 
 jobs:
   release:
-    if: |-
-      ${{ startsWith(github.event.head_commit.message, 'Release: v') }}
-    name: 'Release'
-    uses: 'google-github-actions/.github/.github/workflows/release.yml@v1' # ratchet:exclude
-    # secrets must be explicitly passed to reusable workflows https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows\#using-inputs-and-secrets-in-a-reusable-workflow
+    uses: 'google-github-actions/.github/.github/workflows/release.yml@v3' # ratchet:exclude
     secrets:
       ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'