diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e66118492..32fd09d74 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ permissions:
 jobs:
   ci:
     name: Run CI Pipeline
-    uses: SocketDev/socket-registry/.github/workflows/ci.yml@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+    uses: SocketDev/socket-registry/.github/workflows/ci.yml@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
     with:
       test-setup-script: 'pnpm run build'
       lint-script: 'pnpm run lint --all'
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
         with:
           node-version: '24'
 
diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml
index bfed00983..0bfb231a7 100644
--- a/.github/workflows/provenance.yml
+++ b/.github/workflows/provenance.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   publish:
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
     with:
       debug: ${{ inputs.debug }}
       package-name: '@socketsecurity/lib'
diff --git a/.github/workflows/weekly-update.yml b/.github/workflows/weekly-update.yml
index 72189cc6e..b3b95e377 100644
--- a/.github/workflows/weekly-update.yml
+++ b/.github/workflows/weekly-update.yml
@@ -24,13 +24,12 @@ jobs:
     outputs:
       has-updates: ${{ steps.check.outputs.has-updates }}
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
 
       - name: Check for npm updates
         id: check
         shell: bash
         run: |
-          alias pnpm="$SFW_BIN pnpm"
           echo "Checking for npm package updates..."
           HAS_UPDATES=false
           NPM_UPDATES=$(pnpm outdated 2>/dev/null || true)
@@ -49,7 +48,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
 
       - name: Create update branch
         id: branch
@@ -61,7 +60,7 @@ jobs:
           git checkout -b "$BRANCH_NAME"
           echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
         with:
           gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
 
@@ -73,14 +72,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GITHUB_ACTIONS: 'true'
         run: |
-          # Wrap pnpm through Socket firewall for all subprocesses (not just this shell).
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           if [ -z "$ANTHROPIC_API_KEY" ]; then
             echo "ANTHROPIC_API_KEY not set - skipping automated update"
             echo "success=false" >> $GITHUB_OUTPUT
@@ -132,13 +123,6 @@ jobs:
         if: steps.update.outputs.success == 'true'
         shell: bash
         run: |
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           set +e
           pnpm run build 2>&1 | tee build-output.log
           BUILD_EXIT=$?
@@ -166,13 +150,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           GITHUB_ACTIONS: 'true'
         run: |
-          if [ -n "$SFW_BIN" ]; then
-            mkdir -p /tmp/sfw-bin
-            printf '#!/bin/bash\nexec "%s" pnpm "$@"\n' "$SFW_BIN" > /tmp/sfw-bin/pnpm
-            chmod +x /tmp/sfw-bin/pnpm
-            export PATH="/tmp/sfw-bin:$PATH"
-          fi
-
           # Collect failure context for the agent.
           FAILURE_LOG=""
           if [ -f build-output.log ]; then
@@ -318,7 +295,7 @@ jobs:
             test-output.log
           retention-days: 7
 
-      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@6147a08ccc20fcb1f690dcc4650ec745776b3345 # main
         if: always()
 
   notify: