diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4522c3c..e139e0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,12 +1,10 @@
 name: CI
-on: {pull_request: {}}
+on: { pull_request: { } }
 concurrency:
   group: ${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 permissions:
-  contents: write
-  packages: write
-  issues: write
+  contents: read
 jobs:
   jobs:
     strategy:
@@ -15,10 +13,10 @@ jobs:
         target: [phplint, phpcs, phpunit]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2
         with:
           php-version: '8.3'
           tools: composer
@@ -28,7 +26,7 @@ jobs:
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Save/restore composer cache directory dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -51,3 +49,21 @@ jobs:
         run: |
           composer exec phpunit -- tests/
         if: matrix.target == 'phpunit'
+
+  build-container:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Build container
+        uses: infrabits/ci-pack@001c648d32409db5ab5273f4070bdb7ddaaa14b0 # main
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          image: ghcr.io/${{ github.repository }}:${{ github.sha }}
+          use_builder: latest
+          buildpack: heroku/php
+          publish_image: false
+          runtime_release: ${{ github.sha }}
diff --git a/.github/workflows/renovate_release.yml b/.github/workflows/renovate_release.yml
index 518f866..88f0a08 100644
--- a/.github/workflows/renovate_release.yml
+++ b/.github/workflows/renovate_release.yml
@@ -1,95 +1,19 @@
 name: Create Release For Renovate
 on: { push: { branches: [ 'main' ] } }
-permissions:
-  deployments: write
-  contents: write
 jobs:
-  check-changes:
+  renovate-release:
     runs-on: ubuntu-latest
-    outputs:
-      latest_tag: ${{ steps.check-changes.outputs.latest_tag }}
-      have_only_renovate_commits: ${{ steps.check-changes.outputs.have_only_renovate_commits }}
+    permissions:
+      contents: write
     steps:
-      - name: Check changes since last release
-        id: check-changes
-        uses: actions/github-script@v9
+      - uses: infrabits/ci-create-renovate-release@99a3ddfb889b29e15f753beac630159376f82d27 # main
         with:
-          script: |
-            const { data: { tag_name: latest_tag } } = await github.rest.repos.getLatestRelease({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            });
-            core.setOutput('latest_tag', latest_tag);
-
-            const comparison = await github.rest.repos.compareCommitsWithBasehead({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              basehead: `${latest_tag}...HEAD`,
-            });
-
-            const commits = comparison.data.commits;
-            const isRenovate = c =>
-              c.author?.login === 'renovate[bot]' &&
-              c.author?.type === 'Bot' &&
-              c.author?.id === 29139614;
-
-            const renovateCommits = commits.filter(isRenovate);
-            const otherCommits = commits.filter(c => !isRenovate(c));
-
-            console.log(`[${latest_tag}] Found ${renovateCommits.length} renovate & ${otherCommits.length} other commits`);
-            if (renovateCommits.length > 0 && otherCommits.length === 0) {
-              core.setOutput('have_only_renovate_commits', '1');
-            }
-
-  generate-new-tag:
-    runs-on: ubuntu-latest
-    needs: check-changes
-    outputs:
-      tag_name: ${{ steps.get-tag.outputs.tag_name }}
-    steps:
-      - name: Calculate next release tag
-        id: get-tag
-        run: |
-          # Assume some semantic ish version, increase the minor version
-          latest_tag="${{ needs.check-changes.outputs.latest_tag }}"
-
-          # If the version is `v<timestamp>` then use the current timestamp
-          if [ ! -z "$(grep -E '^v[0-9]+$' <<< "${latest_tag}")" ];
-          then
-            echo "Latest tag looks like a timestamp, using current timestamp"
-            echo "tag_name=v$(date +%s)" >> "$GITHUB_OUTPUT"
-            exit
-          fi
-
-          # If the version is semantic, then increase the patch version
-          if [ ! -z "$(grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' <<< "${latest_tag}")" ];
-          then
-            echo "Latest tag looks like a semantic version, increasing patch"
-            echo "tag_name=$(awk -F '.' '{print $1"."$2"."($3 + 1)}' <<< "${latest_tag}")" >> "$GITHUB_OUTPUT"
-            exit
-          fi
-
-          echo "Could not figure out tag format: $latest_tag"
-          exit 2
-    if: needs.check-changes.outputs.have_only_renovate_commits == '1'
-
-  create-release:
-    runs-on: ubuntu-latest
-    needs: generate-new-tag
-    steps:
-      - name: Create a new release
-        uses: actions/github-script@v9
-        with:
-          script: |
-            const tag_name = '${{ needs.generate-new-tag.outputs.tag_name }}';
-
-            const release = await github.rest.repos.createRelease({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              name: `Release ${tag_name}`,
-              tag_name: tag_name,
-              draft: false,
-              prerelease: false,
-              generate_release_notes: true,
-            });
-            console.log(`Created release for tag ${tag_name}`);
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  deploy:
+    needs: [renovate-release]
+    uses: ./.github/workflows/deploy.yml
+    with:
+      ref: 'refs/tags/${{ needs.renovate-release.outputs.tag_name }}'
+    secrets: inherit
+    if: needs.renovate-release.outputs.tag_name != ''
diff --git a/.github/workflows/tag_release.yml b/.github/workflows/tag_release.yml
index 4687e0b..bad067a 100644
--- a/.github/workflows/tag_release.yml
+++ b/.github/workflows/tag_release.yml
@@ -1,14 +1,18 @@
 name: Create Release For Tag
 on: { push: { tags: [ 'v*' ] } }
-permissions:
-  deployments: write
-  contents: write
 jobs:
   create-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: cluebotng/ci-create-release@main
+      - name: Create GitHub release
+        uses: infrabits/ci-create-missing-release@7887466cff50f3885bf0c270cab70d22246f748e # main
         with:
-          repo_name: '${{ github.repository }}'
-          tag_name: '${{ github.ref }}'
-          gh_app_key: '${{ secrets.CI_RELEASE_MAKER_APP_KEY }}'
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: '${{ github.ref }}'
+
+  deploy:
+    needs: [create-release]
+    uses: ./.github/workflows/deploy.yml
+    secrets: inherit
diff --git a/renovate.json b/renovate.json
index b96d971..7aecd6a 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,7 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
   ],
   "automerge": true,
   "automergeStrategy": "rebase"