diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32cb2db..958f99b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,10 +6,7 @@ on:
   pull_request:
     branches: [main, develop]
 
-env:
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-
+# Optional Turborepo remote cache: add repo secrets TURBO_TOKEN + TURBO_TEAM and set env on jobs.
 jobs:
   lint-and-typecheck:
     name: Lint and Type Check
@@ -89,10 +86,10 @@ jobs:
         run: pnpm test
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         if: always()
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          # Public repos: omit token (uses GITHUB_TOKEN). Private: add CODECOV_TOKEN secret.
           files: ./coverage/lcov.info
           fail_ci_if_error: false
 
@@ -136,7 +133,7 @@ jobs:
           submodules: recursive
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.36.0
         continue-on-error: true
         with:
           scan-type: 'fs'