diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..1bcb63d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Whole CI surface via the org node gold-standard reusable: TS
+  # lint/type-check, tests, build, dependency audit, CodeQL, secret
+  # scanning, dependency review. Replaces lint.and.build.yml + codeql.yml +
+  # security.yml.
+  ci:
+    uses: netresearch/.github/.github/workflows/node-ci.yml@main
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+      pull-requests: write
+    with:
+      package-manager: bun
+      type-check-cmd: "bun run build:lib"
+      build-cmd: "bun run build:lib"
+      enable-format-check: false
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index df4dde9..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: 'CodeQL'
-
-on:
-  push:
-    branches: ['main']
-  pull_request:
-    branches: ['main']
-  schedule:
-    - cron: '18 21 * * 2'
-
-permissions: {}
-
-jobs:
-  # CodeQL runs through the org's shared reusable in netresearch/.github,
-  # so the pinned github/codeql-action versions are maintained centrally
-  # instead of bumped per-repo by Renovate.
-  analyze:
-    uses: netresearch/.github/.github/workflows/codeql.yml@main
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    with:
-      languages: javascript-typescript
diff --git a/.github/workflows/lint.and.build.yml b/.github/workflows/lint.and.build.yml
deleted file mode 100644
index 490f52f..0000000
--- a/.github/workflows/lint.and.build.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: 🔎 Lint
-
-on:
-    workflow_dispatch:
-    push:
-        branches-ignore: [gh-pages]
-    pull_request:
-        branches-ignore: [gh-pages]
-        types: [opened, synchronize]
-
-permissions:
-    contents: read
-
-concurrency:
-    group: ci-${{ github.ref }}
-    cancel-in-progress: true
-
-env:
-    HUSKY: '0'
-
-jobs:
-    build:
-        name: 🔨 Build
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-              with:
-                  node-version: 24
-
-            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-
-            - name: ⚡ Install dependencies
-              run: bun install --frozen-lockfile
-
-            - name: 🔨 Build
-              run: bun run build:lib
-
-    test:
-        name: 🧪 Test
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-              with:
-                  node-version: 24
-
-            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-
-            - name: ⚡ Install dependencies
-              run: bun install --frozen-lockfile
-
-            - name: 🧪 Test
-              run: bun run test:coverage
-
-    lint:
-        name: 🔎 Lint
-        runs-on: ubuntu-24.04
-        steps:
-            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-              with:
-                  node-version: 24
-
-            - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-
-            - name: ⚡ Install dependencies
-              run: bun install --frozen-lockfile
-
-            - name: 🔎 Lint
-              run: bun run lint
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
deleted file mode 100644
index ef62637..0000000
--- a/.github/workflows/security.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Security
-
-# Aggregated security scans: secret scanning (gitleaks), dependency review on
-# PRs, and a Node.js dependency audit.
-#
-# Top-level `permissions: {}` denies everything by default; each reusable
-# caller job re-declares the exact union its reusable requires, so the token
-# passed to each reusable is fully explicit and never relies on the repo
-# default (default_workflow_permissions). This is the same contract proven in
-# netresearch/.github's go-app / php-module templates.
-
-on:
-    push:
-        branches: [main, master]
-    pull_request:
-
-permissions: {}
-
-jobs:
-    gitleaks:
-        uses: netresearch/.github/.github/workflows/gitleaks.yml@main
-        permissions:
-            contents: read
-            security-events: write
-        secrets:
-            GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
-
-    dependency-review:
-        if: github.event_name == 'pull_request'
-        uses: netresearch/.github/.github/workflows/dependency-review.yml@main
-        permissions:
-            contents: read
-            pull-requests: write
-
-    node-audit:
-        uses: netresearch/.github/.github/workflows/node-audit.yml@main
-        permissions:
-            contents: read
-        with:
-            package-manager: bun
-            audit-level: high