diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
deleted file mode 100644
index 750602f0..00000000
--- a/.forgejo/workflows/build.yaml
+++ /dev/null
@@ -1,134 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'recipes/**/recipe.kdl'
-
-jobs:
-  detect:
-    runs-on: docker-aarch64
-    container:
-      image: mere/ci:v0.18.1
-    outputs:
-      matrix: ${{ steps.detect.outputs.matrix }}
-      has_recipes: ${{ steps.detect.outputs.has_recipes }}
-    steps:
-      - name: Git checkout
-        run: |
-          set -eu
-          git init "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
-          git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \
-            fetch --depth=2 origin "$GITHUB_SHA"
-          git checkout --detach FETCH_HEAD
-
-      - name: Detect changed recipes
-        id: detect
-        run: |
-          set -eu
-          cd "$GITHUB_WORKSPACE"
-
-          # For merge commits, diff against first parent.
-          if git cat-file -t HEAD^2 >/dev/null 2>&1; then
-            changed=$(
-              git diff --name-only HEAD^1 HEAD \
-                | grep '^recipes/[^/]*/[^/]*/recipe\.kdl$' || true
-            )
-          else
-            changed=$(
-              git diff --name-only HEAD~1 HEAD \
-                | grep '^recipes/[^/]*/[^/]*/recipe\.kdl$' || true
-            )
-          fi
-
-          if [ -z "$changed" ]; then
-            printf 'No recipe changes detected.\n'
-            printf 'has_recipes=false\n' >> "$GITHUB_OUTPUT"
-            printf 'matrix={\"include\":[]}\n' >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Build matrix includes by reading archs from each recipe
-          includes="[]"
-          for recipe in $changed; do
-            # Extract the archs line: archs "x86_64" or archs "aarch64" "x86_64" or archs "any"
-            archs=$(sed -n 's/.*archs[[:space:]]*//p' "$recipe" | tr -d '"' | tr -s ' ')
-
-            case "$archs" in
-              *any*)
-                # Arch-independent: build once on aarch64
-                includes=$(printf '%s' "$includes" | jq -c ". + [{\"recipe\": \"$recipe\", \"arch\": \"aarch64\"}]")
-                ;;
-              *)
-                # Build for each listed arch
-                for arch in $archs; do
-                  includes=$(printf '%s' "$includes" | jq -c ". + [{\"recipe\": \"$recipe\", \"arch\": \"$arch\"}]")
-                done
-                ;;
-            esac
-          done
-
-          printf 'has_recipes=true\n' >> "$GITHUB_OUTPUT"
-          printf 'matrix=%s\n' "{\"include\":$includes}" >> "$GITHUB_OUTPUT"
-          printf 'Building: %s\n' "$changed"
-          printf 'Matrix: %s\n' "{\"include\":$includes}"
-
-  build:
-    needs: detect
-    if: needs.detect.outputs.has_recipes == 'true'
-    runs-on: ${{ matrix.arch == 'aarch64' && 'docker-aarch64' || 'docker' }}
-    container:
-      image: mere/ci:v0.18.1
-      options: --privileged --cpus=8 --memory=12g
-    strategy:
-      matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
-      fail-fast: false
-    env:
-      MERE_NO_HARDEN: "1"
-      MERE_SIGNING_KEY: ${{ secrets.MERE_SIGNING_KEY }}
-      PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }}
-    steps:
-      - name: Git checkout
-        run: |
-          set -eu
-          git init "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
-          git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \
-            fetch --depth=1 origin "$GITHUB_SHA"
-          git checkout --detach FETCH_HEAD
-
-      - name: Setup signing key
-        run: |
-          set -eu
-          grep -q '^root:' /etc/passwd 2>/dev/null || printf 'root:x:0:0:root:/root:/bin/sh\n' >> /etc/passwd
-          install -d -m 700 /root
-          install -d -m 700 /root/.mere/keys
-          printf '%s' "$MERE_SIGNING_KEY" | base64 -d > /root/.mere/keys/mere.key
-          chmod 600 /root/.mere/keys/mere.key
-
-      - name: Build
-        run: |
-          set -eu
-          cd "$GITHUB_WORKSPACE"
-          mere dev build "${{ matrix.recipe }}"
-
-      - name: Publish to pkgd
-        run: |
-          set -eu
-          archives=$(find /mere/dev/outputs -name '*.pkg.tar.zst' -type f)
-          if [ -z "$archives" ]; then
-            printf '::error::Build produced no archives\n'
-            exit 1
-          fi
-
-          curl_args="-sS --fail-with-body"
-          curl_args="$curl_args -H 'Authorization: Bearer $PKGD_PUBLISH_TOKEN'"
-          for archive in $archives; do
-            curl_args="$curl_args -F package=@$archive"
-          done
-
-          printf 'Publishing %d archive(s) to pkgd\n' $(printf '%s\n' "$archives" | wc -l)
-          eval curl $curl_args https://pkgs.merelinux.org/publish
diff --git a/.forgejo/workflows/validate.yaml b/.forgejo/workflows/validate.yaml
deleted file mode 100644
index 9ce672dd..00000000
--- a/.forgejo/workflows/validate.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-on:
-  pull_request:
-
-jobs:
-  validate:
-    runs-on: docker-aarch64
-    container:
-      image: mere/ci:v0.18.1
-    steps:
-      - name: Git checkout
-        run: |
-          set -eu
-          git init "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git remote add origin "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git"
-          git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \
-            fetch --depth=1 origin "$GITHUB_SHA"
-          git checkout --detach FETCH_HEAD
-
-      - name: Validate changed recipes
-        run: |
-          set -eu
-          cd "$GITHUB_WORKSPACE"
-
-          if [ -z "${GITHUB_BASE_REF:-}" ]; then
-            printf '%s\n' "GITHUB_BASE_REF is not set for this pull request." >&2
-            exit 1
-          fi
-
-          git -c http.extraHeader="Authorization: Bearer $GITHUB_TOKEN" \
-            fetch --depth=50 origin "$GITHUB_BASE_REF"
-
-          changed_recipes=$(
-            git diff --name-only "origin/$GITHUB_BASE_REF...$GITHUB_SHA" \
-              | grep '^recipes/[^/][^/]*/[^/][^/]*/recipe\.kdl$' || true
-          )
-
-          if [ -z "$changed_recipes" ]; then
-            printf '%s\n' "No recipe.kdl changes to validate."
-            exit 0
-          fi
-
-          printf '%s\n' "$changed_recipes" | while IFS= read -r recipe; do
-            [ -n "$recipe" ] || continue
-            printf 'Validating %s\n' "$recipe"
-            mere dev validate "$recipe"
-          done
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index b3cde7fc..c68358fa 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,7 +20,7 @@ jobs:
   detect:
     runs-on: ubuntu-24.04-arm
     container:
-      image: mere/ci:v0.18.5
+      image: mere/ci:v0.18.6
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       MANUAL_RECIPES: ${{ inputs.recipes }}
@@ -120,7 +120,7 @@ jobs:
     if: needs.detect.outputs.has_recipes == 'true'
     runs-on: ${{ matrix.runner }}
     container:
-      image: mere/ci:v0.18.5
+      image: mere/ci:v0.18.6
       options: --privileged --cpus=4 --memory=12g
     strategy:
       matrix: ${{ fromJSON(needs.detect.outputs.matrix) }}
@@ -128,8 +128,8 @@ jobs:
     env:
       MERE_NO_HARDEN: "1"
       MERE_SIGNING_KEY: ${{ secrets.MERE_SIGNING_KEY }}
-      PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PKGD_PUBLISH_TOKEN: ${{ secrets.PKGD_PUBLISH_TOKEN }}
     steps:
       - name: Git checkout
         run: |
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 06b97f59..c53bb0da 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -10,7 +10,7 @@ jobs:
   validate:
     runs-on: ubuntu-24.04
     container:
-      image: mere/ci:v0.18.5
+      image: mere/ci:v0.18.6
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps: