diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88d90417a..8afb2721b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,20 +10,12 @@ on:
 
   workflow_dispatch:
 
-  workflow_call:
-    inputs:
-      ref:
-        required: true
-        type: string
-
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
       - uses: pnpm/action-setup@v5
       - uses: actions/setup-node@v6
         with:
@@ -73,8 +65,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -124,8 +114,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Turborepo
       - name: Cache turbo build setup
@@ -171,8 +159,6 @@ jobs:
     if: ${{ !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.label, 'moeru-ai:i18n/')) }}
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref || github.ref }}
 
       # Node.js
       - uses: pnpm/action-setup@v5
@@ -190,7 +176,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.ref || github.ref }}
           fetch-depth: 0
       - uses: danielroe/provenance-action@main
         id: check
diff --git a/.github/workflows/update-nix-assets-hash.yaml b/.github/workflows/update-nix-assets-hash.yaml
index 1f22bdd12..26b2980c6 100644
--- a/.github/workflows/update-nix-assets-hash.yaml
+++ b/.github/workflows/update-nix-assets-hash.yaml
@@ -17,8 +17,6 @@ jobs:
   update:
     if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
-    outputs:
-      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -32,6 +30,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: main # Use main regardless of workflow_dispatch branch
+          # Authenticate git with PAT so that pushing to head retriggers CI
+          token: ${{ secrets.HASH_UPDATE_TOKEN }}
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -52,7 +52,8 @@ jobs:
       - name: Create PR
         if: steps.changes.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Create PR with PAT to trigger CI
+          GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -72,11 +73,3 @@ jobs:
 
           # Enable auto-merge so PR merges once checks pass
           gh pr merge --squash --auto --delete-branch chore/update-nix-assets-hash
-
-  # Call CI as reusable workflow because bot PR doesn't trigger CI
-  ci:
-    needs: update
-    if: needs.update.outputs.has_changes == 'true'
-    uses: ./.github/workflows/ci.yml
-    with:
-      ref: chore/update-nix-assets-hash
diff --git a/.github/workflows/update-nix-pnpm-deps-hash.yaml b/.github/workflows/update-nix-pnpm-deps-hash.yaml
index ca606ba65..3017db639 100644
--- a/.github/workflows/update-nix-pnpm-deps-hash.yaml
+++ b/.github/workflows/update-nix-pnpm-deps-hash.yaml
@@ -16,8 +16,6 @@ jobs:
   update:
     if: github.event_name == 'workflow_dispatch' || !github.event.repository.fork
     runs-on: ubuntu-latest
-    outputs:
-      has_changes: ${{ steps.changes.outputs.has_changes }}
     steps:
       # Why?
       #
@@ -31,6 +29,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: main # Use main regardless of workflow_dispatch branch
+          # Authenticate git with PAT so that pushing to head retriggers CI
+          token: ${{ secrets.HASH_UPDATE_TOKEN }}
 
       - uses: cachix/install-nix-action@v31
         with:
@@ -51,7 +51,8 @@ jobs:
       - name: Create PR
         if: steps.changes.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Create PR with PAT to trigger CI
+          GH_TOKEN: ${{ secrets.HASH_UPDATE_TOKEN }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -71,11 +72,3 @@ jobs:
 
           # Enable auto-merge so PR merges once checks pass
           gh pr merge --squash --auto --delete-branch chore/update-nix-pnpm-deps-hash
-
-  # Call CI as reusable workflow because bot PR doesn't trigger CI
-  ci:
-    needs: update
-    if: needs.update.outputs.has_changes == 'true'
-    uses: ./.github/workflows/ci.yml
-    with:
-      ref: chore/update-nix-pnpm-deps-hash