diff --git a/.github/actions/restore-build/action.yml b/.github/actions/restore-build/action.yml
index d5fa070d41..b0bf6f6fb6 100644
--- a/.github/actions/restore-build/action.yml
+++ b/.github/actions/restore-build/action.yml
@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Download build artifacts
-      uses: actions/download-artifact@v8
+      uses: DevinoSolutions/artifact/download@v1
       with:
         name: ${{ inputs.artifact-name }}
         path: /tmp/build-output
diff --git a/.github/actions/restore-dependencies/action.yml b/.github/actions/restore-dependencies/action.yml
index a0e4f814f4..f77ef605f9 100644
--- a/.github/actions/restore-dependencies/action.yml
+++ b/.github/actions/restore-dependencies/action.yml
@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Download dependency artifacts
-      uses: actions/download-artifact@v8
+      uses: DevinoSolutions/artifact/download@v1
       with:
         name: ${{ inputs.artifact-name }}
         path: /tmp/node-dependencies
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a22bbdf4d5..8200b74515 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,6 +23,7 @@ on:
 
 jobs:
   install-node-dependencies:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Install node dependencies
     runs-on: ubuntu-latest
     timeout-minutes: 15
@@ -43,13 +44,14 @@ jobs:
         run: tar -czf /tmp/pnpm-store.tar.gz ${{ env.PNPM_STORE_DIR }}
 
       - name: Upload dependency artifacts
-        uses: actions/upload-artifact@v7
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: node-dependencies
           path: /tmp/pnpm-store.tar.gz
           retention-days: 1
 
   build-packages:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Build packages
     runs-on: ubuntu-latest
     needs: install-node-dependencies
@@ -73,13 +75,14 @@ jobs:
         run: tar -czf /tmp/build-output.tar.gz packages/*/dist packages-deprecated/*/dist demos/dist
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: build-output
           path: /tmp/build-output.tar.gz
           retention-days: 1
 
   check-linting-formatting:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Check linting & formatting
     runs-on: ubuntu-latest
     needs: build-packages
@@ -100,6 +103,7 @@ jobs:
         run: pnpm run lint
 
   run-unit-tests:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Run unit tests
     runs-on: ubuntu-latest
     needs: build-packages
@@ -122,6 +126,7 @@ jobs:
         run: pnpm run test:unit
 
   run-e2e-tests:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Run e2e tests (shard ${{ matrix.shard }}/${{ matrix.total }})
     runs-on: ubuntu-latest
     needs: build-packages
@@ -152,13 +157,14 @@ jobs:
 
       - name: Upload blob report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: e2e-blob-report-${{ matrix.shard }}
           path: blob-report
           retention-days: 7
 
   merge-e2e-reports:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: Merge e2e reports
     runs-on: ubuntu-latest
     needs: run-e2e-tests
@@ -177,7 +183,7 @@ jobs:
       - uses: ./.github/actions/restore-dependencies
 
       - name: Download blob reports
-        uses: actions/download-artifact@v8
+        uses: DevinoSolutions/artifact/download@v1
         with:
           path: all-blob-reports
           pattern: e2e-blob-report-*
@@ -188,7 +194,7 @@ jobs:
         run: pnpm exec playwright merge-reports --reporter html ./all-blob-reports
 
       - name: Upload merged HTML report
-        uses: actions/upload-artifact@v7
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: playwright-html-report
           path: playwright-report
diff --git a/.github/workflows/conote-ai.yml b/.github/workflows/conote-ai.yml
index dbfc6a3f1e..7b816f85bb 100644
--- a/.github/workflows/conote-ai.yml
+++ b/.github/workflows/conote-ai.yml
@@ -55,6 +55,7 @@ jobs:
           packages/conote-extension-ai-agent
 
   e2e:
+    permissions: write-all # GITHUB_TOKEN defaults + id-token for DevinoSolutions/artifact (OIDC)
     name: E2E tests (live OpenRouter)
     runs-on: ubuntu-latest
     needs: unit
@@ -109,7 +110,7 @@ jobs:
 
       - name: Upload Playwright report
         if: ${{ failure() && steps.guard.outputs.has_key == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: playwright-report
           path: conote-demo/playwright-report/
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index dde44a3807..fe34ad6080 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,6 +11,7 @@ on:
       - v2
 
 permissions:
+  id-token: write
   contents: read
 
 concurrency:
@@ -62,7 +63,7 @@ jobs:
         run: tar -cf package-dist-artifacts.tar packages/*/dist packages-deprecated/*/dist
 
       - name: Upload package dist artifacts
-        uses: actions/upload-artifact@v7
+        uses: DevinoSolutions/artifact/upload@v1
         with:
           name: package-dist-artifacts
           if-no-files-found: error
@@ -97,7 +98,7 @@ jobs:
         run: pnpm install --frozen-lockfile --strict-peer-dependencies
 
       - name: Download package dist artifacts
-        uses: actions/download-artifact@v8
+        uses: DevinoSolutions/artifact/download@v1
         with:
           name: package-dist-artifacts
           path: .