diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index ff79be98..637d7b9f 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -148,6 +148,27 @@ jobs:
             release-assets/*.tar.gz
             release-assets/*.zip
 
+      - name: Verify SLSA attestations
+        run: |
+          set -e
+          fail=0
+          for f in release-assets/*.tar.gz release-assets/*.zip; do
+            [ -f "$f" ] || continue
+            echo "Verifying attestation for: $f"
+            if gh attestation verify "$f" \
+                --repo "${{ github.repository }}" \
+                --signer-workflow "${{ github.repository }}/.github/workflows/publish-release.yml"; then
+              echo "  OK"
+            else
+              echo "  FAILED"
+              fail=1
+            fi
+          done
+          [ "$fail" -ne 0 ] && exit 1
+          echo "All release artifacts have verified SLSA provenance attestations"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
       - name: Generate checksums index
         run: |
           cd release-assets
diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index fd27edae..b8be1453 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -577,7 +577,7 @@ jobs:
     
     steps:
       - name: Download All Artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           path: artifacts
       
@@ -629,8 +629,8 @@ jobs:
           files: |
             release-assets/*.tar.gz
             release-assets/*.sha256
+            release-assets/*.md5
             release-assets/*.sbom.cdx.json
-            release-assets/CHECKSUMS-SHA256.txt
           fail_on_unmatched_files: false
           # Create draft release for tag push (immutable releases)
           draft: true
@@ -670,7 +670,7 @@ jobs:
 
     steps:
       - name: Download PHP ${{ matrix.php }} NTS Bundle
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           pattern: "${{ matrix.bundle_pattern }}"
           path: bundle
diff --git a/.github/workflows/release-macos.yml b/.github/workflows/release-macos.yml
index cecfc873..85aef30f 100644
--- a/.github/workflows/release-macos.yml
+++ b/.github/workflows/release-macos.yml
@@ -440,7 +440,7 @@ jobs:
 
     steps:
       - name: Download All Artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           path: artifacts
 
@@ -490,8 +490,8 @@ jobs:
           files: |
             release-assets/*.tar.gz
             release-assets/*.sha256
+            release-assets/*.md5
             release-assets/*.sbom.cdx.json
-            release-assets/CHECKSUMS-SHA256.txt
           fail_on_unmatched_files: false
           draft: true
         env:
@@ -522,7 +522,7 @@ jobs:
           echo "PHP version: $(php -v | head -1)"
 
       - name: Download Bundle
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           pattern: "*macos*${{ matrix.arch }}*"
           path: bundle
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index 4f83e5a4..9dc2138a 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -113,8 +113,6 @@ jobs:
           $sdkPath = "C:\firebird-sdk"
           echo "FIREBIRD_HOME=$sdkPath" >> $env:GITHUB_ENV
           echo "$sdkPath\bin" >> $env:GITHUB_PATH
-          echo "CFLAGS=-I$sdkPath\include" >> $env:GITHUB_ENV
-          echo "LDFLAGS=-L$sdkPath\lib" >> $env:GITHUB_ENV
 
       - name: Build Extension
         uses: php/php-windows-builder/extension@c49dae50774b14e0f358d2efa65637b67f1104f6 # v1
@@ -150,7 +148,7 @@ jobs:
           fi
 
       - name: Download All Build Artifacts
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           path: artifacts