diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..b0cd5f4698
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+# Custom labels for the self-hosted runners; actionlint cannot discover them.
+self-hosted-runner:
+  labels:
+    - normal
+    - fast
+    - ARM64
diff --git a/.github/actions/with-docker/action.yml b/.github/actions/with-docker/action.yml
index 1ab3314dcd..8e2367a45c 100644
--- a/.github/actions/with-docker/action.yml
+++ b/.github/actions/with-docker/action.yml
@@ -3,54 +3,32 @@ description: 'Run a given stage with Docker Image'
 inputs:
   container-name:
     description: 'Docker container name to use'
-    type: string
     required: true
   tag-name:
     description: 'Docker image tag to use'
-    type: string
     required: false
     default: runtimeverificationinc/kevm
-  subdir:
-    description: 'Subdirectory where code is cloned.'
-    required: false
-    type: string
-    default: './'
-  os:
-    description: 'OS to setup Docker for.'
-    required: false
-    type: string
-    default: 'ubuntu'
-  distro:
-    description: 'Distribution to setup Docker for.'
-    required: false
-    type: string
-    default: 'jammy'
   llvm:
     description: 'LLVM version to use.'
     required: false
-    type: number
     default: 14
   dockerfile:
     description: 'Hardcode the path of the dockerfile to use.'
     required: false
-    type: string
     default: '.github/workflows/Dockerfile'
 runs:
   using: 'composite'
   steps:
   - name: 'Set up Docker'
+    env:
+      CONTAINER_NAME: ${{ inputs.container-name }}
+      DOCKERFILE: ${{ inputs.dockerfile }}
+      LLVM_VERSION: ${{ inputs.llvm }}
+      TAG_NAME: ${{ inputs.tag-name }}
     shell: bash {0}
     run: |
       set -euxo pipefail
 
-      CONTAINER_NAME=${{ inputs.container-name }}
-      SUBDIR=${{ inputs.subdir }}
-      BASE_OS=${{ inputs.os }}
-      BASE_DISTRO=${{ inputs.distro }}
-      DOCKERFILE=${{ inputs.dockerfile }}
-      LLVM_VERSION=${{ inputs.llvm }}
-      TAG_NAME=${{ inputs.tag-name }}
-
       USER=github-user
       GROUP=${USER}
       Z3_VERSION=$(cat deps/z3)
@@ -59,27 +37,26 @@ runs:
       USER_ID=1000
       GROUP_ID=${USER_ID}
 
-      docker build . --file ${DOCKERFILE}        \
-        --tag ${TAG_NAME}                        \
-        --build-arg USER_ID=${USER_ID}           \
-        --build-arg GROUP_ID=${GROUP_ID}         \
-        --build-arg USER=${USER}                 \
-        --build-arg GROUP=${GROUP}               \
-        --build-arg BASE_DISTRO=${BASE_DISTRO}   \
-        --build-arg K_VERSION=${K_VERSION}       \
-        --build-arg Z3_VERSION=${Z3_VERSION}     \
-        --build-arg LLVM_VERSION=${LLVM_VERSION} \
-        --build-arg UV_VERSION=${UV_VERSION}
+      docker build . --file "${DOCKERFILE}"         \
+        --tag "${TAG_NAME}"                         \
+        --build-arg USER_ID="${USER_ID}"            \
+        --build-arg GROUP_ID="${GROUP_ID}"          \
+        --build-arg USER="${USER}"                  \
+        --build-arg GROUP="${GROUP}"                \
+        --build-arg K_VERSION="${K_VERSION}"        \
+        --build-arg Z3_VERSION="${Z3_VERSION}"      \
+        --build-arg LLVM_VERSION="${LLVM_VERSION}"  \
+        --build-arg UV_VERSION="${UV_VERSION}"
 
-      docker run                          \
-        --name ${CONTAINER_NAME}          \
-        --rm                              \
-        --interactive                     \
-        --tty                             \
-        --detach                          \
-        --user root                       \
-        --workdir /home/${USER}/workspace \
-        ${TAG_NAME}
+      docker run                            \
+        --name "${CONTAINER_NAME}"          \
+        --rm                                \
+        --interactive                       \
+        --tty                               \
+        --detach                            \
+        --user root                         \
+        --workdir "/home/${USER}/workspace" \
+        "${TAG_NAME}"
 
-      docker cp . ${CONTAINER_NAME}:/home/${USER}/workspace
-      docker exec ${CONTAINER_NAME} chown -R ${USER}:${GROUP} /home/${USER}
+      docker cp . "${CONTAINER_NAME}":"/home/${USER}/workspace"
+      docker exec "${CONTAINER_NAME}" chown -R "${USER}:${GROUP}" "/home/${USER}"
diff --git a/.github/scripts/check-cachix-pin.sh b/.github/scripts/check-cachix-pin.sh
deleted file mode 100755
index db5439cf31..0000000000
--- a/.github/scripts/check-cachix-pin.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Kup relies on cachix registry k-framework-binary.
-CACHE="k-framework-binary"
-OWNER_REPO="${OWNER_REPO:-$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')}"
-REV="${REV:-${GITHUB_SHA:-$(git rev-parse HEAD)}}"
-UNAME_S="$(uname -s)"
-UNAME_M="$(uname -m)"
-case "${UNAME_S}-${UNAME_M}" in
-  Linux-x86_64) SYSTEM="x86_64-linux" ;;
-  Linux-aarch64 | Linux-arm64) SYSTEM="aarch64-linux" ;;
-  Darwin-x86_64) SYSTEM="x86_64-darwin" ;;
-  Darwin-arm64) SYSTEM="aarch64-darwin" ;;
-  *)
-    echo "Unsupported platform: ${UNAME_S}-${UNAME_M}" >&2
-    exit 1
-    ;;
-esac
-PIN_API_URL="https://app.cachix.org/api/v1/cache/${CACHE}/pin"
-CHECK_PACKAGES=(kevm)
-
-SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
-
-# Append to the GitHub step summary when set; always print to stdout for live job logs.
-summary_and_log() {
-  if [[ "${SUMMARY}" == "/dev/stdout" ]]; then
-    cat
-  else
-    tee -a "${SUMMARY}"
-  fi
-}
-
-{
-  echo "## Cachix Publish Summary"
-  echo "CACHE: $CACHE"
-  echo "OWNER_REPO: $OWNER_REPO"
-  echo "REV: $REV"
-  echo "SYSTEM: $SYSTEM"
-  echo "PACKAGES: ${CHECK_PACKAGES[*]}"
-} >> "$SUMMARY"
-
-# Verify push + pin together for each package. Both can become visible with delay.
-PIN_VISIBILITY_TIMEOUT_SECONDS=120 # 2 minutes
-PIN_VISIBILITY_INTERVAL_SECONDS=5  # 5 seconds
-PIN_VISIBILITY_ATTEMPTS=$((PIN_VISIBILITY_TIMEOUT_SECONDS / PIN_VISIBILITY_INTERVAL_SECONDS))
-for i in $(seq 1 "$PIN_VISIBILITY_ATTEMPTS"); do
-  PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}")"
-  ALL_OK=1
-
-  for PKG in "${CHECK_PACKAGES[@]}"; do
-    KEY="github:${OWNER_REPO}/${REV}#packages.${SYSTEM}.${PKG}"
-    STORE_PATH="$(
-      echo "$PIN_JSON" \
-        | jq -r --arg k "$KEY" 'map(select(.name == $k)) | first | (.lastRevision.storePath // .storePath // .store_path // .path // "")'
-    )"
-    if [ -z "$STORE_PATH" ]; then
-      PIN_STATUS="pin-missing"
-      PUSH_STATUS="000"
-      ALL_OK=0
-      {
-        echo "key-${PKG}: ${KEY}"
-        echo "pin-status-${PKG}: ${PIN_STATUS}"
-        echo "push-http-${PKG}: ${PUSH_STATUS}"
-      } | summary_and_log
-      continue
-    fi
-
-    PIN_STATUS="pin-ok"
-    HASH="$(basename "$STORE_PATH" | cut -d- -f1)"
-    PUSH_NARINFO_URL="https://${CACHE}.cachix.org/${HASH}.narinfo"
-    PUSH_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' "$PUSH_NARINFO_URL")" || PUSH_STATUS="000"
-    if [ "$PUSH_STATUS" != "200" ]; then
-      ALL_OK=0
-    fi
-
-    {
-      echo "key-${PKG}: ${KEY}"
-      echo "store-path-${PKG}: ${STORE_PATH}"
-      echo "pin-status-${PKG}: ${PIN_STATUS}"
-      echo "push-http-${PKG}: ${PUSH_STATUS}"
-    } | summary_and_log
-  done
-
-  if [ "$ALL_OK" = "1" ]; then
-    echo "cachix-status: push-and-pin-ok-for-all-packages" >> "$SUMMARY"
-    exit 0
-  fi
-
-  RETRY_MSG="cachix-check-attempt-${i}: not-ready, retrying in ${PIN_VISIBILITY_INTERVAL_SECONDS}s"
-  printf '%s\n' "$RETRY_MSG" | summary_and_log
-  sleep "$PIN_VISIBILITY_INTERVAL_SECONDS"
-done
-
-echo "cachix-status: push-or-pin-missing-after-${PIN_VISIBILITY_TIMEOUT_SECONDS}s-for-at-least-one-package" >> "$SUMMARY"
-# Pin API bulk JSON goes to job logs only (step summary stays readable); helps if the response shape changes.
-echo "check-cachix-pin: raw Cachix pin API response (last fetch):" >&2
-echo "$PIN_JSON" >&2
-exit 1
diff --git a/.github/workflows/Dockerfile b/.github/workflows/Dockerfile
index 75bcf51e40..e77cd1ac58 100644
--- a/.github/workflows/Dockerfile
+++ b/.github/workflows/Dockerfile
@@ -1,6 +1,5 @@
 ARG Z3_VERSION
 ARG K_VERSION
-ARG BASE_DISTRO
 ARG LLVM_VERSION
 
 ARG Z3_VERSION
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000000..aec14283a2
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,52 @@
+name: 'Lint Workflows'
+on:
+  pull_request:
+    branches:
+      - 'master'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: 'actionlint'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Install actionlint'
+        env:
+          # Pin the release and verify it, both values should be updated together.
+          ACTIONLINT_VERSION: '1.7.12'
+          ACTIONLINT_SHA256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8'
+        run: |
+          set -euxo pipefail
+          curl --fail --silent --show-error --location --output actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum --check --strict
+          tar --extract --gzip --file actionlint.tar.gz actionlint
+      - name: 'Run actionlint'
+        run: ./actionlint -color
+
+  zizmor:
+    name: 'zizmor'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write  # upload SARIF, so findings annotate the diff
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Run zizmor'
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        with:
+          version: '1.29.0'
+          online-audits: false
+          advanced-security: true
diff --git a/.github/workflows/master-push.yml b/.github/workflows/master-push.yml
deleted file mode 100644
index 8721682102..0000000000
--- a/.github/workflows/master-push.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: 'Bump Version and Start Release Job'
-on:
-  push:
-    branches:
-      - 'master'
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-jobs:
-  version-bump:
-    name: 'Version Bump'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          # fetch-depth 0 means deep clone the repo
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ secrets.JENKINS_GITHUB_PAT}}
-      - name: 'Configure GitHub user'
-        run: |
-          git config user.name rv-jenkins
-          git config user.email devops@runtimeverification.com
-      - name: 'Update version'
-        run: |
-          set -x
-          git checkout -B release origin/release
-          old_master="$(git merge-base origin/master origin/release)"
-          new_master="$(git rev-parse origin/master)"
-          if git diff --exit-code ${old_master} ${new_master} -- package/version; then
-            git merge --no-edit origin/master
-            ./package/version.sh bump
-          else
-            git merge --no-edit --strategy-option=theirs origin/master
-          fi
-          ./package/version.sh sub
-          if git add --update && git commit --no-edit --allow-empty --message "Set Version: $(cat package/version)"; then
-            git push origin release
-            git tag "release-$(cat package/version)" origin/master
-            git push origin "release-$(cat package/version)"
-          fi
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 4dbd05a430..0000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,172 +0,0 @@
-name: 'Release'
-on:
-  push:
-    branches:
-      - 'release'
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-jobs:
-  draft-release:
-    name: 'Draft Release'
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.make-release.outputs.version }}
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-      - name: 'Make release'
-        id: 'make-release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release create ${VERSION}                  \
-            --repo runtimeverification/evm-semantics  \
-            --draft                                     \
-            --title ${VERSION}                          \
-            --target ${{ github.sha }}
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-  nix-cache:
-    name: 'Populate Nix Caches'
-    strategy:
-      matrix:
-        include:
-          - runner: normal
-          - runner: ARM64
-    runs-on: ${{ matrix.runner }}
-    needs: draft-release
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.push.head.sha }}
-          fetch-depth: 0
-      - name: 'Build KEVM'
-        run: |
-          GC_DONT_GC=1 nix build --extra-experimental-features 'nix-command flakes' --print-build-logs
-      - name: 'Push KEVM dependencies to nix cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: 1
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-        with:
-          packages: jq
-          script: |
-            kevm=$(nix build --extra-experimental-features 'nix-command flakes' .#kevm --json | jq -r '.[].outputs | to_entries[].value')
-            drv=$(nix-store --query --deriver ${kevm})
-            nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework || true
-      - name: 'Publish KEVM to k-framework-binary cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: '1'
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
-          OWNER_REPO: '${{ github.repository }}'
-          REV: '${{ github.sha }}'
-        with:
-          packages: jq
-          script: |
-            export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
-            kup publish k-framework-binary .#kevm --keep-days 180 || true
-            # Cachix has not been responding to 'cachix pin' requests made under the hood by kup. Verify the push and pin manually.
-            .github/scripts/check-cachix-pin.sh
-      - name: 'On failure, delete drafted release'
-        if: failure()
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release delete ${VERSION}                  \
-            --repo runtimeverification/evm-semantics  \
-            --yes                                       \
-            --cleanup-tag
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-
-  make-release:
-    name: 'Cut Release'
-    runs-on: ubuntu-latest
-    needs: [draft-release, nix-cache]
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.push.head.sha }}
-          fetch-depth: 0
-      - name: 'Make release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release edit ${VERSION}                    \
-            --repo runtimeverification/evm-semantics  \
-            --draft=false
-      - name: 'Update dependents'
-        run: |
-          set -x
-          VERSION=$(cat package/version)
-          curl --fail                                                          \
-            -X POST                                                            \
-            -H "Accept: application/vnd.github+json"                           \
-            -H "Authorization: Bearer ${{ secrets.JENKINS_GITHUB_PAT }}"       \
-            -H "X-GitHub-Api-Version: 2022-11-28"                              \
-            https://api.github.com/repos/runtimeverification/devops/dispatches \
-            -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/evm-semantics","version":"'${VERSION}'"}}'
-
-  gh-pages:
-    name: 'Publish GH Pages'
-    runs-on: ubuntu-latest
-    needs: [make-release]
-    steps:
-      - name: 'Check out gh-pages'
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: true
-          ref: ${{ github.event.push.head.sha }}
-      - run: |
-         git config --global user.email 'devops@runtimeverification.com'
-         git config --global user.name  'rv-jenkins'
-      - name: 'Publish gh-pages'
-        run: |
-          git checkout -B gh-pages
-          cd web
-          npm install
-          npm run build
-          npm run build-sitemap
-          cd -
-          mv web/public_content ./
-          rm -rf $(find . -maxdepth 1 -not -name public_content -a -not -name .git -a -not -name .gitmodules -a -not -path . -a -not -path .. -a -not -name CNAME)
-          mv public_content/* ./
-          rm -rf public_content
-          git add ./
-          git commit -m 'gh-pages: Updated the website'
-          git merge --strategy ours origin/gh-pages --allow-unrelated-histories
-          git push origin gh-pages
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      - name: 'Post success to channel'
-        if: success()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Created KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index bd20200bb2..941030fb7f 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -7,23 +7,30 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# No job here writes to the repository, so the token stays read-only regardless of
+# the repository default.
+permissions:
+  contents: read
+
 jobs:
   kevm-pyk-code-quality-checks:
     name: 'Code Quality Checks'
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Setup Python 3.10'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.10'
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run code quality checks'
@@ -37,13 +44,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run unit tests'
@@ -55,13 +64,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run profiling'
@@ -75,9 +86,10 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: recursive
+          persist-credentials: false
       - name: 'Set up Docker'
         uses: ./.github/actions/with-docker
         with:
@@ -95,7 +107,9 @@ jobs:
       - name: 'Tear down Docker'
         if: always()
         run: |
-          docker stop --time=0 kevm-ci-concrete-${{ github.sha }}
+          # Best effort: the container does not exist if 'Set up Docker' failed, and a
+          # non-zero exit here would mask the step that actually failed.
+          docker stop --timeout=0 kevm-ci-concrete-${{ github.sha }} || true
 
   test-prove:
     name: 'Proofs: ${{ matrix.name }}'
@@ -138,7 +152,9 @@ jobs:
     timeout-minutes: ${{ matrix.timeout }}
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Check out select submodules'
         run: |
           set -eux
@@ -154,7 +170,9 @@ jobs:
       - name: 'Tear down Docker'
         if: always()
         run: |
-          docker stop --time=0 kevm-ci-haskell-${{ matrix.test-suite }}-${{ github.sha }}
+          # Best effort: the container does not exist if 'Set up Docker' failed, and a
+          # non-zero exit here would mask the step that actually failed.
+          docker stop --timeout=0 kevm-ci-haskell-${{ matrix.test-suite }}-${{ github.sha }} || true
 
   nix:
     name: 'Nix'
@@ -169,10 +187,11 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           # Check out pull request HEAD instead of merge commit.
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
       - name: 'Check out select submodules'
         run: |
           set -eux
diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml
deleted file mode 100644
index 28b6a60724..0000000000
--- a/.github/workflows/update-version.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: 'Update Version'
-on:
-  push:
-    branches:
-      - '_update-deps/runtimeverification/blockchain-k-plugin'
-      - '_update-deps/runtimeverification/k'
-      - '_update-deps/runtimeverification/rv-nix-tools'
-      - '_update-deps-cron/uv2nix'
-      - '_update-deps-cron/pyproject-build-systems'
-  workflow_dispatch:
-# Stop in progress workflows on the same branch and same workflow to use latest committed code
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-
-  update-versions:
-    name: 'Update Dependency Versions'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.JENKINS_GITHUB_PAT }}
-      - name: 'Configure GitHub user'
-        run: |
-          git config user.name devops
-          git config user.email devops@runtimeverification.com
-      - name: 'Get uv release'
-        id: uv_release
-        run: |
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          UV_VERSION=$(curl -s https://raw.githubusercontent.com/pyproject-nix/uv2nix/$(cat deps/uv2nix)/pkgs/uv-bin/srcs.json | jq -r .version)
-          [[ "${UV_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          echo ${UV_VERSION} > deps/uv_release
-          git add deps/uv_release && git commit -m "Sync uv version: uv ${UV_VERSION}" || true
-          echo uv_version=${UV_VERSION} >> "${GITHUB_OUTPUT}"
-      - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: ${{ steps.uv_release.outputs.uv_version }}
-      - name: 'Update pyk release tag'
-        run: |
-          K_VERSION=$(cat deps/k_release)
-          sed -i 's!    "kframework==[0-9\.]*",!    "kframework=='${K_VERSION}'",!' kevm-pyk/pyproject.toml
-          if ! grep -q "kframework==$K_VERSION" kevm-pyk/pyproject.toml; then
-            echo "Update failed: kframework==$K_VERSION not found"; exit 1
-          fi
-          uv --project kevm-pyk lock --upgrade
-          git add kevm-pyk/ && git commit -m "kevm-pyk/: sync uv files pyk version ${K_VERSION}" || true
-      - name: 'Update plugin release file'
-        run: |
-          BKP_VERSION=$(git -C kevm-pyk/src/kevm_pyk/kproj/plugin rev-parse HEAD)
-          echo ${BKP_VERSION} > deps/blockchain-k-plugin_release
-          git add deps/blockchain-k-plugin_release && git commit -m "deps/blockchain-k-plugin_release: sync release file version ${BKP_VERSION}" || true
-      - name: 'Install Nix/Cachix'
-        uses: cachix/install-nix-action@v31.5.1
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.30.1/install
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - uses: cachix/cachix-action@v12
-        with:
-          name: k-framework
-          authToken: ${{ secrets.CACHIX_PUBLIC_TOKEN }}
-      - name: 'Update nix flake inputs'
-        run: |
-          K_VERSION=v$(cat deps/k_release)
-          BKP_VERSION=$(cat deps/blockchain-k-plugin_release)
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          PYPROJECT_BUILD_SYSTEMS_VERSION=$(cat deps/pyproject-build-systems)
-          RV_NIX_TOOLS_VERSION=$(cat deps/rv-nix-tools)
-          sed -i 's!    k-framework.url = "github:runtimeverification/k/[v0-9\.]*"!    k-framework.url = "github:runtimeverification/k/'"${K_VERSION}"'"!' flake.nix
-          sed -i 's!        "github:runtimeverification/blockchain-k-plugin/[0-9a-f]*"!        "github:runtimeverification/blockchain-k-plugin/'"${BKP_VERSION}"'"!' flake.nix
-          sed -i 's!    uv2nix.url = "github:pyproject-nix/uv2nix/[a-z0-9\.]*"!    uv2nix.url = "github:pyproject-nix/uv2nix/'"${UV2NIX_VERSION}"'"!' flake.nix
-          sed -i 's!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/[a-z0-9\.]*"!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/'"${PYPROJECT_BUILD_SYSTEMS_VERSION}"'"!' flake.nix
-          sed -i 's!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/[a-z0-9\.]*"!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/'"${RV_NIX_TOOLS_VERSION}"'"!' flake.nix
-          nix run .#update-from-submodules
-          nix flake update
-          git add flake.nix flake.lock && git commit -m 'flake.{nix,lock}: update Nix derivations' || true
-      - name: 'Push updates'
-        run: git push