diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 50dc1d2..32ac336 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,31 +7,25 @@ on:
         branches: [main]
     merge_group: {}
 
+permissions:
+    contents: read
+
 jobs:
     test:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                     fetch-depth: 0
+                    persist-credentials: false
 
-            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-
-            - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
-              with:
-                node-version-file: '.nvmrc'
-                registry-url: 'https://registry.npmjs.org'
-                cache: pnpm
-            
-            - name: Install
-              run: pnpm install
+            - uses: better-auth/shared-workflows/.github/actions/setup-pnpm@08e5520e7a829b03bee1152913682b67d2ba44b1
 
             - name: Build
               run: pnpm build
-            
+
             - name: Test
               run: pnpm test
 
             - name: Typecheck
               run: pnpm typecheck
-            
\ No newline at end of file
diff --git a/.github/workflows/lint-github-actions.yml b/.github/workflows/lint-github-actions.yml
new file mode 100644
index 0000000..07a2f2f
--- /dev/null
+++ b/.github/workflows/lint-github-actions.yml
@@ -0,0 +1,37 @@
+name: Lint GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/actions/**"
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+  push:
+    branches: [main]
+    paths:
+      - ".github/actions/**"
+      - ".github/workflows/**"
+      - ".github/zizmor.yml"
+
+permissions: {}
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+    uses: better-auth/shared-workflows/.github/workflows/lint-github-actions.yml@08e5520e7a829b03bee1152913682b67d2ba44b1
+
+  zizmor:
+    if: github.event_name == 'pull_request'
+    permissions:
+      actions: read
+      contents: read
+    uses: better-auth/shared-workflows/.github/workflows/zizmor.yml@08e5520e7a829b03bee1152913682b67d2ba44b1
+
+  zizmor-code-scanning:
+    if: github.event_name == 'push'
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: better-auth/shared-workflows/.github/workflows/zizmor-code-scanning.yml@08e5520e7a829b03bee1152913682b67d2ba44b1