diff --git a/.github/scripts/sync-template.sh b/.github/scripts/sync-template.sh
index 3ebc1827..dbf4135a 100755
--- a/.github/scripts/sync-template.sh
+++ b/.github/scripts/sync-template.sh
@@ -371,7 +371,7 @@ done
 
 # Reusable workflow callers must use a literal repository/ref. Render the
 # selected runtime repository while leaving custom workflows untouched.
-for file in .github/workflows/ci.yml .github/workflows/test.yml; do
+for file in .github/workflows/ci.yml .github/workflows/test.yml .github/workflows/security.yml .github/workflows/codeql.yml; do
   [ -f "$file" ] || continue
   if grep -q '0xPlayerOne/code-foundry' "$file"; then
     changed=$((changed + 1))
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e0591b9..b79caed1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,5 +13,8 @@ permissions:
 jobs:
   ci:
     name: CI
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-ci.yml@v0.7.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-ci.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 42324e0b..0af4e9b2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,5 +18,8 @@ permissions:
 jobs:
   codeql:
     name: CodeQL
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.12.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit
diff --git a/.github/workflows/reusable-ci.yml b/.github/workflows/reusable-ci.yml
index 797d6300..69a842f3 100644
--- a/.github/workflows/reusable-ci.yml
+++ b/.github/workflows/reusable-ci.yml
@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.7.0
+        default: v0.14.0
 
 permissions:
   contents: read
diff --git a/.github/workflows/reusable-codeql.yml b/.github/workflows/reusable-codeql.yml
index 0fc8293c..3e7e37c1 100644
--- a/.github/workflows/reusable-codeql.yml
+++ b/.github/workflows/reusable-codeql.yml
@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.11.0
+        default: v0.14.0
 
 permissions:
   actions: read
diff --git a/.github/workflows/reusable-security.yml b/.github/workflows/reusable-security.yml
index 5ff25123..dba614f5 100644
--- a/.github/workflows/reusable-security.yml
+++ b/.github/workflows/reusable-security.yml
@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.9.0
+        default: v0.14.0
 
 permissions:
   contents: read
diff --git a/.github/workflows/reusable-test.yml b/.github/workflows/reusable-test.yml
index 2521f7fe..6fe9a93a 100644
--- a/.github/workflows/reusable-test.yml
+++ b/.github/workflows/reusable-test.yml
@@ -12,7 +12,7 @@ on:
         description: Code Foundry runtime tag or ref.
         required: false
         type: string
-        default: v0.7.0
+        default: v0.14.0
 
 permissions:
   contents: read
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5f262266..001b6384 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -13,5 +13,8 @@ permissions:
 jobs:
   security:
     name: Security
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.10.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 97c092f8..3b4322e3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,5 +13,8 @@ permissions:
 jobs:
   test:
     name: Test
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-test.yml@v0.8.0
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-test.yml@v0.14.0
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.14.0
     secrets: inherit