diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 62254f5..f3b0a4e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: ["master"]
   pull_request:
-    branches: ["master"]
+    branches: ["master", "codex/**"]
 
 permissions: read-all
 
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27.1"
+          go-version: "1.27.4"
       - name: Verify the pinned interpreter
         run: test "$(go list -m -f '{{.Version}}' go.starlark.net)" = "v0.0.0-20260324133313-ffb3f39dd27a"
       - name: Guard the compatible crypto dependency boundary
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27.1"
+          go-version: "1.27.4"
       - name: Build the runtime image
         run: |
           CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o starcli .
@@ -54,7 +54,7 @@ jobs:
     # Star* module's pipeline. Pinned to a commit SHA for supply-chain safety;
     # bump the pin when meta's workflow changes (Dependabot github-actions can
     # automate this).
-    uses: 1set/meta/.github/workflows/go-ci.yml@23f088bcd6dce16c93e0056d7b70b4f4434208e8
+    uses: 1set/meta/.github/workflows/go-ci.yml@6b334e6a2762acaeefcea9fc7d3e86964e9246be
     with:
       # Match go.mod's compatibility floor; the shared workflow also tests
       # the current stable Go release.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c4aea23..904ece0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
     branches: ["master"]
     tags: ["v*"]
   pull_request:
-    branches: ["master"]
+    branches: ["master", "codex/**"]
 
 permissions:
   contents: read
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27.1"
+          go-version: "1.27.4"
       - name: Check source vulnerabilities
         run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
       - name: Select release or snapshot build
@@ -79,7 +79,7 @@ jobs:
             target: linux_arm64.tar.gz
           - os: macos-15-intel
             target: macOS_amd64.tar.gz
-          - os: macos-14
+          - os: macos-15
             target: macOS_arm64.tar.gz
           - os: windows-2022
             target: windows_amd64.zip
@@ -91,7 +91,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.27.1"
+          go-version: "1.27.4"
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"