diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4750aa7..be3dcdc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,8 +11,6 @@
 name: CodeQL
 on:
   pull_request:
-  push:
-    branches: [main]
   schedule:
     - cron: '0 6 * * 1'  # weekly, Monday morning
 
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
deleted file mode 100644
index 6a7af85..0000000
--- a/.github/workflows/playwright.yml
+++ /dev/null
@@ -1,76 +0,0 @@
-# Playwright functional and visual regression tests.
-#
-# This is an opt-in scaffold. The steps below are commented out because a
-# freshly scaffolded project has no Playwright tests yet. Enabling this
-# workflow before tests exist would produce a red or empty CI job on every
-# pull request, which is the opposite of the quality goal.
-#
-# To enable this workflow for a project:
-#   1. Write at least one Playwright test in your project (e.g. tests/e2e/).
-#   2. Uncomment the steps below.
-#   3. Replace the placeholder test command with your project's actual command.
-#   4. Commit the updated workflow.
-#
-# This workflow is gated to code-type projects. Documentation-type projects
-# do not receive this file during sync.
-#
-# Action versions were verified against GitHub and pinned to commit SHAs
-# on 2026-06-02. The version tag is shown in the trailing comment. To
-# update an action, change the SHA and the comment together.
-#
-# Relationship to accessibility.yml: this workflow covers functional flows
-# and visual regression. accessibility.yml covers WCAG conformance via
-# Pa11y and axe-core. Both serve different layers and must both be green
-# before a PR merges.
-
-name: Playwright
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  playwright:
-    name: Playwright tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
-
-      # --- Uncomment and adapt when the project has Playwright tests ---
-
-      # - name: Set up Node.js
-      #   uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-      #   with:
-      #     node-version: lts/*
-      #     cache: npm
-
-      # - name: Install dependencies
-      #   run: npm ci
-
-      # - name: Install Playwright browsers
-      #   # --with-deps installs system dependencies (libnss3, etc.) on the runner.
-      #   run: npx playwright install --with-deps
-
-      # - name: Run Playwright tests
-      #   # Replace this command with the project's actual test command.
-      #   # Examples:
-      #   #   npx playwright test
-      #   #   npm run test:e2e
-      #   #   npx playwright test --reporter=html
-      #   run: npx playwright test
-
-      # - name: Upload Playwright report
-      #   # Upload the HTML report as an artifact on failure so it can be
-      #   # inspected without re-running the tests.
-      #   if: failure()
-      #   uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
-      #   with:
-      #     name: playwright-report
-      #     path: playwright-report/
-      #     retention-days: 7
-
-      - name: Placeholder
-        # Remove this step once the steps above are uncommented.
-        run: echo "Playwright tests are not yet configured for this project. See the comments in this file for setup instructions."
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b8e541d..2b919b8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -17,12 +17,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - name: Cache pip packages for Semgrep
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-semgrep-1.166.0
       - name: Semgrep
         # semgrep scan runs locally with the default ruleset and exits non-zero
         # on any finding. semgrep ci requires a SEMGREP_APP_TOKEN and uses
         # cloud-based CI mode; it is not used here to avoid token dependency.
         run: |
-          pip install semgrep
+          pip install semgrep==1.166.0
           semgrep scan --config p/default --error
 
   trivy: