diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index a86b4ad..f88c6ff 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -31,11 +31,19 @@ on:
       - main
       - develop
 
+permissions:
+  contents: read
+
 env:
   CACTI: 1.2.x
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   integration-test:
+    timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     
     strategy:
@@ -46,7 +54,7 @@ jobs:
     
     services:
       mariadb:
-        image: mariadb:11.8
+        image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15
         env:
           MYSQL_ROOT_PASSWORD: cactiroot
           MYSQL_DATABASE: cacti
@@ -66,6 +74,7 @@ jobs:
     - name: Checkout Cacti
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        persist-credentials: false
         repository: Cacti/cacti
         ref: ${{ env.CACTI }}
         path: cacti
@@ -73,6 +82,7 @@ jobs:
     - name: Checkout servcheck Plugin
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
+        persist-credentials: false
         path: cacti/plugins/servcheck
         # patch-coverage.php diffs against the base branch below.
         fetch-depth: 0
@@ -81,6 +91,7 @@ jobs:
       uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
       with:
         php-version: ${{ matrix.php }}
+        tools: composer:2.10.3
         extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp
         ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York"
         coverage: xdebug
@@ -130,29 +141,25 @@ jobs:
         mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql
         mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti
     
-    - name: Validate composer files
-      run: |
-        cd ${{ github.workspace }}/cacti
-        if [ -f composer.json ]; then
-          composer validate --strict || true
-        fi
-    
-    - name: Install Composer Dependencies
-      run: |
-        cd ${{ github.workspace }}/cacti
-        if [ -f composer.json ]; then
-          sudo composer config --no-plugins allow-plugins.pestphp/pest-plugin true
-          sudo composer require --dev --no-progress --no-interaction "pestphp/pest: ^3" "pestphp/pest-plugin-drift: ^3.0"
-          sudo rm -f composer.lock
-          sudo composer install --dev --no-progress
-        fi
+    # Core's release archives exclude .github and tests. Fetch these paths
+    # through Git at the immutable helper revision instead of an Action archive.
+    - name: Checkout shared CI tooling
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        repository: Cacti/cacti
+        ref: f3ff777992875740e4665fedfe2eff8335f5b894
+        persist-credentials: false
+        path: ci-tools
+        sparse-checkout: |
+          .github/actions/setup-plugin-dependencies
+          tests/tools/plugin-harness
+
+    - name: Install locked Cacti and plugin test dependencies
+      uses: ./ci-tools/.github/actions/setup-plugin-dependencies
+      with:
+        cacti-directory: cacti
+        install-core-dev: 'false'
 
-    - name: Restore vendor ownership for Pest
-      run: |
-        if [ -d ${{ github.workspace }}/cacti/include/vendor ]; then
-          sudo chown -R runner:runner ${{ github.workspace }}/cacti/include/vendor ${{ github.workspace }}/cacti/composer.lock
-        fi
-    
     - name: Create Cacti config.php
       run: |
         cat ${{ github.workspace }}/cacti/include/config.php.dist | \
@@ -193,7 +200,7 @@ jobs:
       run: |
         cd ${{ github.workspace }}/cacti
         if [ -f plugins/servcheck/phpunit.xml ] && [ -d plugins/servcheck/tests/Security ]; then
-          include/vendor/bin/pest --configuration=plugins/servcheck/phpunit.xml \
+          "$CACTI_PEST_BIN" --configuration=plugins/servcheck/phpunit.xml \
             --coverage-clover=plugins/servcheck/coverage/clover.xml
         else
           echo "Skipping Pest tests: plugins/servcheck/phpunit.xml or tests/Security not present yet."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f0bfb6..c4fef72 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,4 @@
-# ChangeLog
+# ChangeLog
 
 --- develop ---
 
@@ -15,6 +15,7 @@
 * security: Require a CSRF token on the enable, disable and purge GET actions
 * dev: Bring the plugin to PHPStan level 8 with native return/parameter type declarations and fix the bugs it uncovered (duplicate credential-load block and undefined variables in the MQTT test, a credential lookup checking the wrong variable in the cURL/SSH/REST tests, an SSH private-key cleanup that never ran, a wrong variable in the poller warning, missing globals, dead bulk-action confirmation variables on the credential page, a mistyped credential key and duplicate form-field keys, and several unguarded database-row and certificate accesses)
 * dev: Ensure lib/poller.php is loaded wherever its functions (exec_background, replicate_out_table, unregister_process) are used rather than relying on it being included elsewhere
+* dev: Pin the CI database image and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime
 
 --- 0.4 ---