Worked on the a16z/jolt repository to deliver a comprehensive security upgrade for CI workflows, focusing on access control and artifact validation. Introduced a two-stage review process that separates untrusted fork pull requests from sensitive code review stages, using author association and custom labels to gate access. Hardened workflows by restricting tool usage, pinning dependencies by SHA, and enforcing explicit GitHub token management, all implemented in YAML with GitHub Actions. Updated CODEOWNERS and maintainers to improve auditability and accountability for workflow changes. The enhancements established immutable, auditable CI configurations and reduced the risk of unauthorized access or prompt injection attacks.