diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..6df5712
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,4 @@
+paths:
+  ".github/workflows/**/*.{yaml,yml}":
+    ignore:
+      - 'reusable workflow call "\$/\.github/workflows/security\.yml" at "uses" is not following the format'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 802bee8..9169931 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write
@@ -64,7 +64,7 @@ jobs:
 
       - name: Govulncheck
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
           govulncheck ./...
 
       - name: Verify tag is on main
diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml
index 70f1c1e..12e4ca4 100644
--- a/seed/.github/workflows/release.yml
+++ b/seed/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security scan
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write