diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index d9bcbf9f..f3ea4b21 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,5 +1,6 @@
-# Code owners file.
-# This file controls who is tagged for review for any given pull request.
+#
+# Learn about membership in OpenTelemetry community:
+#  https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
+#
 
- # For anything not explicitly taken by someone else:
 * @open-telemetry/java-approvers @open-telemetry/java-instrumentation-approvers
diff --git a/.github/config/lychee.toml b/.github/config/lychee.toml
index 34e5534b..984620f9 100644
--- a/.github/config/lychee.toml
+++ b/.github/config/lychee.toml
@@ -11,9 +11,9 @@ include_fragments = true
 
 remap = [
   # workaround for https://github.com/lycheeverse/lychee/issues/1729
-  'https://github.com/(.*?)/(.*?)/blob/(.*?)/(.*#.*)$ https://raw.githubusercontent.com/$1/$2/$3/$4',
+  "https://github.com/(.*?)/(.*?)/blob/(.*?)/(.*#.*)$ https://raw.githubusercontent.com/$1/$2/$3/$4",
 ]
 
 exclude = [
-  '^https://github.com/.*#discussion_r.*$',
+  "^https://github.com/.*#discussion_r.*$",
 ]
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 850fc56e..6069c908 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -13,4 +13,5 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 8a2642e6..9ee4f53a 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -25,7 +25,7 @@ jobs:
 
   create-pull-request-against-release-branch:
     permissions:
-      contents: write  # for Git to git push
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     needs:
       - prereqs
@@ -86,7 +86,7 @@ jobs:
 
   create-pull-request-against-main:
     permissions:
-      contents: write  # for Git to git push
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     needs:
       - prereqs
diff --git a/.github/workflows/reusable-misspell-check.yml b/.github/workflows/reusable-misspell-check.yml
index 9de2b744..56df6633 100644
--- a/.github/workflows/reusable-misspell-check.yml
+++ b/.github/workflows/reusable-misspell-check.yml
@@ -14,8 +14,7 @@ jobs:
 
       - name: Install misspell
         run: |
-          curl -L -o install-misspell.sh https://raw.githubusercontent.com/client9/misspell/master/install-misspell.sh
-          sh ./install-misspell.sh
+          curl -sfL https://raw.githubusercontent.com/golangci/misspell/master/install-misspell.sh | sh -s -- -b bin
 
       - name: Run misspell
         run: bin/misspell -error .