diff --git a/.commitlintrc.yml b/.commitlintrc.yml
index 2671da79..927ecd3f 100644
--- a/.commitlintrc.yml
+++ b/.commitlintrc.yml
@@ -24,3 +24,7 @@ rules:
     - 2
     - always
     - 100
+  body-max-line-length:
+    - 0
+  footer-max-line-length:
+    - 0
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 25fb5d12..c038107a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -19,7 +19,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: CI ${{ github.head_ref || github.run_id }}
+  group: CI ${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/dependabot.yaml b/.github/workflows/dependabot.yaml
index ddf25b2e..834dc2ef 100644
--- a/.github/workflows/dependabot.yaml
+++ b/.github/workflows/dependabot.yaml
@@ -19,20 +19,53 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
       - name: Fetch Metadata
         id: metadata
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Check for common-config-managed files
+        id: managed
+        if: steps.metadata.outputs.package-ecosystem == 'github_actions'
+        run: |
+          all_managed=true
+
+          while IFS= read -r file; do
+            if [ ! -f "$file" ] || ! grep -q "synced with beam-community/common-config" "$file"; then
+              all_managed=false
+              break
+            fi
+          done < <(gh pr view "$PR_URL" --json files --jq '.files[].path')
+
+          echo "all_managed=$all_managed" >> "$GITHUB_OUTPUT"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Close PR for common-config-managed files
+        if: steps.managed.outputs.all_managed == 'true'
+        run: |
+          gh pr comment "$PR_URL" --body "Every file this PR touches is synced from beam-community/common-config, so this update has to land there and flow down through the regular sync instead. Closing in favor of that."
+          gh pr close "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Approve PR
+        if: steps.managed.outputs.all_managed != 'true'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto-merge for patch and minor updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'direct:production'
+        if: steps.managed.outputs.all_managed != 'true' && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'direct:production')
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 0a4dd823..95739fa5 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -33,7 +33,7 @@ jobs:
   Labels:
     name: Assign Labels
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'pull_request' }}
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
 
     permissions:
       contents: read
diff --git a/.github/workflows/production.yaml b/.github/workflows/production.yaml
index 81140cd9..8a6a6406 100644
--- a/.github/workflows/production.yaml
+++ b/.github/workflows/production.yaml
@@ -15,6 +15,7 @@ concurrency:
 jobs:
   Hex:
     runs-on: ubuntu-latest
+    if: github.event_name == 'release' || github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/publish-docs.yaml b/.github/workflows/publish-docs.yaml
index 15a0a082..a0715fd0 100644
--- a/.github/workflows/publish-docs.yaml
+++ b/.github/workflows/publish-docs.yaml
@@ -12,7 +12,7 @@ concurrency:
 jobs:
   Hex:
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index d86cec39..cd306eae 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -1,3 +1,5 @@
+# This file is synced with beam-community/common-config. Any changes will be overwritten.
+
 name: "Close stale issues and PRs"
 
 on:
@@ -14,7 +16,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-issue-stale: 30
           days-before-issue-close: 15