diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
index 2f8aece62..29c303fc3 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-require-checker.yml
@@ -16,6 +16,9 @@ on:
 
 name: Composer require checker
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/db-mariadb.yml b/.github/workflows/db-mariadb.yml
new file mode 100644
index 000000000..aca542276
--- /dev/null
+++ b/.github/workflows/db-mariadb.yml
@@ -0,0 +1,25 @@
+on:
+  pull_request:
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/db-mariadb.yml'
+      - 'composer.json'
+      - 'phpunit.xml.dist'
+
+  push:
+    branches: ['master']
+    paths: *paths
+
+name: db-mariadb
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-mariadb.yml@master
diff --git a/.github/workflows/db-mssql.yml b/.github/workflows/db-mssql.yml
index 0050a3eee..b2c163803 100644
--- a/.github/workflows/db-mssql.yml
+++ b/.github/workflows/db-mssql.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/db-mssql.yml'
@@ -9,85 +9,17 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - 'tests/**'
-      - '.github/workflows/db-mssql.yml'
-      - 'composer.json'
-      - 'phpunit.xml.dist'
+    paths: *paths
 
 name: db-mssql
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: PHP ${{ matrix.php }}
-
-    env:
-      extensions: pdo_sqlsrv
-      key: cache-v1
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        php:
-          - 8.1
-          - 8.2
-          - 8.3
-          - 8.4
-          - 8.5
-
-    services:
-      mssql:
-          image: mcr.microsoft.com/mssql/server:2022-latest
-          env:
-              SA_PASSWORD: YourStrong!Passw0rd
-              ACCEPT_EULA: Y
-              MSSQL_PID: Developer
-          ports:
-              - 1433:1433
-          options: --name=mssql --health-cmd="/opt/mssql-tools18/bin/sqlcmd -C -S localhost -U SA -P 'YourStrong!Passw0rd' -Q 'SELECT 1'" --health-interval=10s --health-timeout=5s --health-retries=3
-
-    steps:
-      - name: Install ODBC driver.
-        run: |
-          sudo curl https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/prod.list | sudo tee /etc/apt/sources.list.d/mssql-release.list
-          sudo apt-get clean
-          sudo apt-get update
-          sudo ACCEPT_EULA=Y apt-get install -y msodbcsql18
-
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Create MS SQL Database
-        run: docker exec -i mssql /opt/mssql-tools18/bin/sqlcmd -C -S localhost -U SA -P 'YourStrong!Passw0rd' -Q 'CREATE DATABASE [ar-test]'
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-oracle
-
-      - name: Install required yiisoft/db and yiisoft/db-mssql
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-mssql']
-
-      - name: Run tests with phpunit.
-        run: vendor/bin/phpunit --testsuite=Mssql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations
-
-      - name: Upload coverage to Codecov.
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-mssql.yml@master
diff --git a/.github/workflows/db-mysql.yml b/.github/workflows/db-mysql.yml
index 3426142de..1e6cd8e98 100644
--- a/.github/workflows/db-mysql.yml
+++ b/.github/workflows/db-mysql.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/db-mysql.yml'
@@ -9,76 +9,17 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - 'tests/**'
-      - '.github/workflows/db-mysql.yml'
-      - 'composer.json'
-      - 'phpunit.xml.dist'
+    paths: *paths
 
 name: db-mysql
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: PHP ${{ matrix.php }}
-
-    env:
-      extensions: pdo_mysql
-      key: cache-v1
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        php:
-          - 8.1
-          - 8.2
-          - 8.3
-          - 8.4
-          - 8.5
-
-    services:
-      mysql:
-        image: mysql:latest
-        env:
-          MYSQL_ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: ar-test
-          MYSQL_USER: yii
-          MYSQL_PASSWORD: 'q1w2e3r4'
-        ports:
-          - 3306:3306
-        options: --name=mysql --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
-
-    steps:
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-sqlite yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle
-
-      - name: Install required yiisoft/db and yiisoft/db-mysql
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-mysql']
-
-      - name: Run tests with phpunit.
-        run: vendor/bin/phpunit --testsuite=Mysql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations
-
-      - name: Upload coverage to Codecov.
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-mysql.yml@master
diff --git a/.github/workflows/db-oracle.yml b/.github/workflows/db-oracle.yml
index d548168ab..e9c3a3a90 100644
--- a/.github/workflows/db-oracle.yml
+++ b/.github/workflows/db-oracle.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/db-oracle.yml'
@@ -9,84 +9,17 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - 'tests/**'
-      - '.github/workflows/db-oracle.yml'
-      - 'composer.json'
-      - 'phpunit.xml.dist'
+    paths: *paths
 
 name: db-oracle
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: PHP ${{ matrix.php }}
-
-    env:
-      extensions: pdo_oci
-      key: cache-v1
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        php:
-          - 8.1
-          - 8.2
-          - 8.3
-          - 8.4
-          - 8.5
-
-    services:
-      oci:
-        image: gvenzl/oracle-xe:latest
-        ports:
-          - 1521:1521
-        env:
-          ORACLE_RANDOM_PASSWORD: yes
-          ORACLE_DATABASE: ar_test
-          APP_USER: yii
-          APP_USER_PASSWORD: q1w2e3r4
-        options: >-
-          --name=oci
-          --health-cmd healthcheck.sh
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-
-    steps:
-      - name: Configure Database.
-        run: docker exec -i oci bash -c "sqlplus -s system/root@XE <<< 'ALTER USER system DEFAULT TABLESPACE USERS;'"
-
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql
-
-      - name: Install required yiisoft/db and yiisoft/db-oracle
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-oracle']
-
-      - name: Run tests with phpunit.
-        run: vendor/bin/phpunit --testsuite=Oracle --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations
-
-      - name: Upload coverage to Codecov.
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-oracle.yml@master
diff --git a/.github/workflows/db-pgsql.yml b/.github/workflows/db-pgsql.yml
index 02b28d480..ec0f41eaa 100644
--- a/.github/workflows/db-pgsql.yml
+++ b/.github/workflows/db-pgsql.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/db-pgsql.yml'
@@ -9,74 +9,17 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - 'tests/**'
-      - '.github/workflows/db-pgsql.yml'
-      - 'composer.json'
-      - 'phpunit.xml.dist'
+    paths: *paths
 
 name: db-pgsql
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: PHP ${{ matrix.php }}
-
-    env:
-      extensions: pdo_pgsql
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        php:
-          - 8.1
-          - 8.2
-          - 8.3
-          - 8.4
-          - 8.5
-
-    services:
-      postgres:
-        image: postgres:18
-        env:
-          POSTGRES_DB: ar-test
-          POSTGRES_USER: yii
-          POSTGRES_PASSWORD: q1w2e3r4
-        ports:
-          - 5432:5432
-        options: --name=postgres --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
-
-    steps:
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle
-
-      - name: Install required yiisoft/db and yiisoft/db-pgsql
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-pgsql']
-
-      - name: Run tests with phpunit.
-        run: vendor/bin/phpunit --testsuite=Pgsql --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations
-
-      - name: Upload coverage to Codecov.
-        uses: codecov/codecov-action@v3
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-pgsql.yml@master
diff --git a/.github/workflows/db-sqlite.yml b/.github/workflows/db-sqlite.yml
index bd0b4722c..8995ba22a 100644
--- a/.github/workflows/db-sqlite.yml
+++ b/.github/workflows/db-sqlite.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - 'tests/**'
       - '.github/workflows/db-sqlite.yml'
@@ -9,68 +9,17 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - 'tests/**'
-      - '.github/workflows/db-sqlite.yml'
-      - 'composer.json'
-      - 'phpunit.xml.dist'
+    paths: *paths
 
 name: db-sqlite
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: PHP ${{ matrix.php }}-sqlite-${{ matrix.os }}
-
-    env:
-      extensions: pdo_sqlite
-      key: cache-v1
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-
-        php:
-          - 8.1
-          - 8.2
-          - 8.3
-          - 8.4
-          - 8.5
-
-    steps:
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: date.timezone='UTC'
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-mysql yiisoft/db-pgsql yiisoft/db-mssql yiisoft/db-oracle
-
-      - name: Install required yiisoft/db and yiisoft/db-sqlite
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-sqlite']
-
-      - name: Run tests with phpunit.
-        run: vendor/bin/phpunit --testsuite=Sqlite --coverage-clover=coverage.xml --colors=always --display-warnings --display-deprecations
-
-      - name: Upload coverage to Codecov.
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./coverage.xml
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-sqlite.yml@master
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 6912041ba..9e0c247bf 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -1,76 +1,26 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
+      - 'resources/**'
       - 'src/**'
+      - 'tests/**'
       - '.github/workflows/mutation.yml'
       - 'composer.json'
+      - 'infection.json.dist'
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/mutation.yml'
-      - 'composer.json'
+    paths: *paths
+
+name: mutation
 
-name: Mutation
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  mutation:
-    name: PHP ${{ matrix.php }}-${{ matrix.os }}
-
-    env:
-      extensions: pdo_pgsql
-
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        os:
-          - ubuntu-latest
-        php:
-          - 8.5
-
-    services:
-      postgres:
-        image: postgres:18
-        env:
-          POSTGRES_DB: ar-test
-          POSTGRES_USER: yii
-          POSTGRES_PASSWORD: q1w2e3r4
-        ports:
-          - 5432:5432
-        options: --name=postgres --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
-
-    steps:
-      - name: Checkout.
-        uses: actions/checkout@v4
-
-      - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          extensions: ${{ env.extensions }}
-          ini-values: memory_limit=-1
-          coverage: pcov
-
-      - name: Remove unused dependencies of DB drivers
-        run: composer remove --dev yiisoft/db-sqlite yiisoft/db-mysql yiisoft/db-mssql yiisoft/db-oracle
-
-      - name: Install Composer dependencies
-        uses: ramsey/composer-install@v3
-
-      - name: Install required yiisoft/db and yiisoft/db-pgsql
-        uses: yiisoft/actions/install-packages@master
-        with:
-          packages: >-
-            ['db', 'db-pgsql']
-
-      - name: Run infection.
-        run: |
-          vendor/bin/infection --ignore-msi-with-no-mutations --test-framework-options="--testsuite=Pgsql"
-        env:
-          STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}
+  tests:
+    uses: yiisoft/actions/.github/workflows/db-mutation.yml@master
diff --git a/.github/workflows/rector-cs.yml b/.github/workflows/rector-cs.yml
index f5b581b1a..c03a88e6f 100644
--- a/.github/workflows/rector-cs.yml
+++ b/.github/workflows/rector-cs.yml
@@ -21,6 +21,6 @@ jobs:
   rector:
     uses: yiisoft/actions/.github/workflows/rector-cs.yml@master
     with:
-      php: '8.1'
+      php: 8.1
       required-packages: >-
         ['db']
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 287f4ac96..4ddb5a663 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,6 +1,6 @@
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - '.github/workflows/static.yml'
       - 'psalm*.xml'
@@ -8,14 +8,13 @@ on:
 
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/static.yml'
-      - 'psalm*.xml'
-      - 'composer.json'
+    paths: *paths
 
 name: Static analysis
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true