diff --git a/.github/workflows/bc.yml_ b/.github/workflows/bc.yml_
index dfde1ec..2557a8c 100644
--- a/.github/workflows/bc.yml_
+++ b/.github/workflows/bc.yml_
@@ -1,15 +1,21 @@
+name: backwards compatibility
+
 on:
-  - pull_request
-  - push
+  pull_request:
+    paths: &paths
+      - 'src/**'
+      - '.github/workflows/bc.yml'
+      - 'composer.json'
+  push:
+    branches: ['master']
+    paths: *paths
+
+permissions:
+  contents: read
 
-name: backwards compatibility
 jobs:
   roave_bc_check:
-    name: Roave BC Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@ab62d6b3b0e0cff6c9724ec5a395bedb41c639a2
-      - name: fetch tags
-        run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      - name: Roave BC Check
-        uses: docker://nyholm/roave-bc-check-ga
+    uses: yiisoft/actions/.github/workflows/bc.yml@master
+    with:
+      php: >-
+        ['8.1']
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 525c682..0907895 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,34 +1,27 @@
+name: build
+
 on:
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'psalm.xml'
-
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/build.yml'
+      - 'composer.json'
+      - 'phpunit.xml.dist'
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'psalm.xml'
-
-name: build
+    branches: ['master']
+    paths: *paths
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   phpunit:
     uses: yiisoft/actions/.github/workflows/phpunit.yml@master
     with:
-      os: >-
-        ['ubuntu-latest', 'windows-latest']
       php: >-
         ['8.0', '8.1']
diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
index cac6665..73fd65f 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-require-checker.yml
@@ -1,36 +1,26 @@
+name: Composer require checker
+
 on:
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-      - 'psalm.xml'
-
+    paths: &paths
+      - 'src/**'
+      - 'config/**'
+      - '.github/workflows/composer-require-checker.yml'
+      - 'composer.json'
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-      - 'psalm.xml'
-
-name: Composer require checker
+    branches: ['master']
+    paths: *paths
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   composer-require-checker:
     uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
     with:
-      os: >-
-        ['ubuntu-latest']
       php: >-
         ['8.0']
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 8f193f6..de9c009 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -1,23 +1,17 @@
+name: mutation test
+
 on:
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'psalm.xml'
-
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/mutation.yml'
+      - 'composer.json'
+      - 'infection.json.dist'
+      - 'phpunit.xml.dist'
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'psalm.xml'
-
-name: mutation test
+    branches: ['master']
+    paths: *paths
 
 permissions:
   contents: read
diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml
index 6b98c18..9fb749c 100644
--- a/.github/workflows/rector-cs.yml
+++ b/.github/workflows/rector-cs.yml
@@ -19,6 +19,8 @@ concurrency:
 
 jobs:
   rector:
+    permissions:
+      contents: write # Required to commit automated Rector and CS fixes
     uses: yiisoft/actions/.github/workflows/rector-cs.yml@master
     with:
       php: '8.0'
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 48ff8eb..416a39a 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,29 +1,24 @@
+name: static analysis
+
 on:
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-
+    paths: &paths
+      - 'src/**'
+      - 'config/**'
+      - '.github/workflows/static.yml'
+      - 'psalm*.xml'
+      - 'composer.json'
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-
-name: static analysis
+    branches: ['master']
+    paths: *paths
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   psalm:
     uses: yiisoft/actions/.github/workflows/psalm.yml@master
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 430255d..7534234 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,21 +1,17 @@
 name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - '.github/**.yml'
-      - '.github/**.yaml'
   pull_request:
-    paths:
+    paths: &paths
       - '.github/**.yml'
       - '.github/**.yaml'
+  push:
+    branches: ['master']
+    paths: *paths
 
 permissions:
-  actions: read # Required by zizmor when reading workflow metadata through the API.
-  contents: read # Required to read workflow files.
+  actions: read # Required by zizmor when reading workflow metadata through the API
+  contents: read # Required to read workflow files
 
 jobs:
   zizmor: