diff --git a/.github/actions/oocana-python/action.yml b/.github/actions/oocana-python/action.yml
index 1ea77b1a..62cbf193 100644
--- a/.github/actions/oocana-python/action.yml
+++ b/.github/actions/oocana-python/action.yml
@@ -21,7 +21,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         repository: oomol/oocana-python
         path: ${{ inputs.path }}
diff --git a/.github/workflows/layer.yml b/.github/workflows/layer.yml
index 04b2247e..5b73c27a 100644
--- a/.github/workflows/layer.yml
+++ b/.github/workflows/layer.yml
@@ -13,11 +13,11 @@ jobs:
     outputs:
       should_skip: ${{ steps.filter.outputs.should_skip }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           filter: blob:none
           fetch-depth: 0
-      - uses: leavesster/pull-request-path-filter@v0.2.2
+      - uses: leavesster/pull-request-path-filter@v0.2
         id: "filter"
         with:
           paths: |
@@ -32,8 +32,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: skip
     if: ${{ needs.skip.outputs.should_skip != 'true' }}
+    env:
+      OVMLAYER_REPOSITORY: ${{ vars.OVMLAYER_REPOSITORY || 'ovmlayer-next' }}
+      OVMLAYER_USE_RUNTIME_SETUP: "true"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pdm-project/setup-pdm@v4
         with:
           cache: true
@@ -49,10 +52,20 @@ jobs:
           sudo apt-add-repository -y ppa:mosquitto-dev/mosquitto-ppa
           sudo apt-get update
           sudo apt-get install -y mosquitto
+      - name: Generate GitHub App Token for oomol/${{ env.OVMLAYER_REPOSITORY }}
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OOMOL_DOWNLOADER_APP_ID }}
+          private-key: ${{ secrets.OOMOL_DOWNLOADER_APP_PRIVATE_KEY }}
+          owner: oomol
+          repositories: ${{ env.OVMLAYER_REPOSITORY }}
       - uses: oomol/oocana-rust/.github/actions/ovmlayer@main
         with:
+          repository: ${{ env.OVMLAYER_REPOSITORY }}
           rootfs: https://github.com/oomol/ovmlayer-rootfs/releases/download/base-rootfs%400.4.0/amd64-rootfs.tar
-          token: ${{ secrets.ACCESS_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          use-runtime-setup: ${{ env.OVMLAYER_USE_RUNTIME_SETUP }}
       - name: modify overlayfs # https://github.com/oomol/ovmlayer/issues/25
         run: |
           sudo bash -c 'echo N > /sys/module/overlay/parameters/redirect_always_follow'
@@ -68,7 +81,7 @@ jobs:
         run: |
           mosquitto -p 47688 -d
           pdm test
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
       - name: test flow examples
         timeout-minutes: 5
         run: |
@@ -78,9 +91,9 @@ jobs:
           npm install
           npm run test
       - name: upload logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: oocana-logs
           path: ~/.oocana/sessions/
           retention-days: 1
-        if: failure()
\ No newline at end of file
+        if: failure()
diff --git a/.github/workflows/oocana-python.yml b/.github/workflows/oocana-python.yml
index f22f2457..09818081 100644
--- a/.github/workflows/oocana-python.yml
+++ b/.github/workflows/oocana-python.yml
@@ -17,12 +17,24 @@ jobs:
     runs-on: ubuntu-latest
     env:
       OVMLAYER_LOG: /tmp/ovmlayer.log
+      OVMLAYER_REPOSITORY: ${{ vars.OVMLAYER_REPOSITORY || 'ovmlayer-next' }}
+      OVMLAYER_USE_RUNTIME_SETUP: "true"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Generate GitHub App Token for oomol/${{ env.OVMLAYER_REPOSITORY }}
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.OOMOL_DOWNLOADER_APP_ID }}
+          private-key: ${{ secrets.OOMOL_DOWNLOADER_APP_PRIVATE_KEY }}
+          owner: oomol
+          repositories: ${{ env.OVMLAYER_REPOSITORY }}
       - uses: oomol/oocana-rust/.github/actions/ovmlayer@main
         with:
+          repository: ${{ env.OVMLAYER_REPOSITORY }}
           rootfs: https://github.com/oomol/ovmlayer-rootfs/releases/download/base-rootfs%400.4.0/amd64-rootfs.tar
-          token: ${{ secrets.ACCESS_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          use-runtime-setup: ${{ env.OVMLAYER_USE_RUNTIME_SETUP }}
       - name: setup oocana-python action without layer
         uses: ./.github/actions/oocana-python
         with:
@@ -36,7 +48,7 @@ jobs:
           path: "oocana-python"
       - name: upload log
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ovmlayer-log
           path: /tmp/ovmlayer.log
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index be74892c..82992ab3 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -13,11 +13,11 @@ jobs:
     outputs:
       should_skip: ${{ steps.filter.outputs.should_skip }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           filter: blob:none
           fetch-depth: 0
-      - uses: leavesster/pull-request-path-filter@v0.2.2
+      - uses: leavesster/pull-request-path-filter@v0.2
         id: "filter"
         with:
           paths: |
@@ -33,7 +33,7 @@ jobs:
     needs: skip
     if: ${{ needs.skip.outputs.should_skip != 'true' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pdm-project/setup-pdm@v4
         with:
           cache: true
@@ -53,7 +53,7 @@ jobs:
         run: |
           mosquitto -p 47688 -d
           pdm test
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22.x
       - name: test flow examples
@@ -68,7 +68,7 @@ jobs:
       #   if: ${{ failure() }}
       #   uses: mxschmitt/action-tmate@v3
       - name: upload logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: oocana-logs
           path: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d5a0eb15..cf4567f9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -40,7 +40,7 @@ jobs:
     needs: vars
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: pdm-project/setup-pdm@v4
         with:
           cache: true