diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index 0577a84..e141add 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -1,27 +1,16 @@
+name: backwards compatibility
+
 on:
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-      - 'psalm.xml'
+    paths: &paths
+      - 'config/**'
+      - 'src/**'
+      - '.github/workflows/bc.yml'
+      - '.roave-backward-compatibility-check.xml'
+      - 'composer.json'
   push:
     branches: ['master']
-    paths-ignore:
-      - 'docs/**'
-      - 'README.md'
-      - 'CHANGELOG.md'
-      - '.gitignore'
-      - '.gitattributes'
-      - 'infection.json.dist'
-      - 'phpunit.xml.dist'
-      - 'psalm.xml'
-
-name: backwards compatibility
+    paths: *paths
 
 permissions:
   contents: read
@@ -30,7 +19,5 @@ jobs:
   roave_bc_check:
     uses: yiisoft/actions/.github/workflows/bc.yml@master
     with:
-      os: >-
-        ['ubuntu-latest']
       php: >-
-        ['8.4']
+        ['8.5']
diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml
index 6307f29..b0154f0 100644
--- a/.github/workflows/rector-cs.yml
+++ b/.github/workflows/rector-cs.yml
@@ -20,6 +20,8 @@ concurrency:
 
 jobs:
   rector:
+    permissions:
+      contents: write # Required to commit automated Rector and CS fixes
     uses: yiisoft/actions/.github/workflows/rector-cs.yml@master
     with:
       php: '8.1'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 430255d..7534234 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,21 +1,17 @@
 name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - '.github/**.yml'
-      - '.github/**.yaml'
   pull_request:
-    paths:
+    paths: &paths
       - '.github/**.yml'
       - '.github/**.yaml'
+  push:
+    branches: ['master']
+    paths: *paths
 
 permissions:
-  actions: read # Required by zizmor when reading workflow metadata through the API.
-  contents: read # Required to read workflow files.
+  actions: read # Required by zizmor when reading workflow metadata through the API
+  contents: read # Required to read workflow files
 
 jobs:
   zizmor:
diff --git a/.roave-backward-compatibility-check.xml b/.roave-backward-compatibility-check.xml
new file mode 100644
index 0000000..670ae63
--- /dev/null
+++ b/.roave-backward-compatibility-check.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<roave-bc-check
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="vendor/roave/backward-compatibility-check/Resources/schema.xsd">
+    <baseline>
+        <ignored-regex>#\[BC\] SKIPPED: Roave\\BetterReflection\\Reflection\\ReflectionClass "Yiisoft\\Yii\\Debug\\#</ignored-regex>
+    </baseline>
+</roave-bc-check>