diff --git a/.github/workflows/droid-create.yml b/.github/workflows/droid-create.yml
index ad334f1..eee1af5 100644
--- a/.github/workflows/droid-create.yml
+++ b/.github/workflows/droid-create.yml
@@ -48,7 +48,7 @@ jobs:
       issues: read
     env:
       GITHUB_TOKEN: ${{ github.token }}
-      DISPATCH_TARGET: ${{ inputs.target || '' }}
+      DISPATCH_TARGET: ${{ github.event.inputs['target'] || '' }}
     outputs:
       key: ${{ steps.key.outputs.key }}
     steps:
@@ -200,9 +200,9 @@ jobs:
       issues: read
     env:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-      DISPATCH_MODE: ${{ inputs.mode || '' }}
-      DISPATCH_PROMPT: ${{ inputs.prompt || '' }}
-      DISPATCH_TARGET: ${{ inputs.target || '' }}
+      DISPATCH_MODE: ${{ github.event.inputs['mode'] || '' }}
+      DISPATCH_PROMPT: ${{ github.event.inputs['prompt'] || '' }}
+      DISPATCH_TARGET: ${{ github.event.inputs['target'] || '' }}
     outputs:
       mode: ${{ steps.ctx.outputs.mode }}
       mode_name: ${{ steps.ctx.outputs.mode_name }}
@@ -517,10 +517,11 @@ jobs:
     if: always() && needs.droid-context.result == 'success' && needs.droid-context.outputs.should_run == 'true' && (needs.droid-approval.result == 'success' || needs.droid-approval.result == 'skipped')
     runs-on: ubuntu-latest
     permissions:
+      actions: read
       contents: read
-      pull-requests: read
+      id-token: write
       issues: read
-      actions: read
+      pull-requests: read
     services:
       postgres:
         image: postgres:16-alpine
@@ -573,6 +574,16 @@ jobs:
           git -c http.https://github.com/.extraheader="AUTHORIZATION: bearer ${GITHUB_TOKEN}" fetch --no-tags origin "+refs/heads/${CHECKOUT_REF}:refs/remotes/origin/${CHECKOUT_REF}"
           git checkout --detach "refs/remotes/origin/${CHECKOUT_REF}"
 
+      - name: Fetch secrets from Infisical
+        uses: WriterInternal/devops-github-actions/infisical-secrets@2b7c38445cb1b9c43f88d7ec990ccb1534078ae8 # v2.4.0
+        with:
+          org-identity-id: ${{ secrets.INFISICAL_ORG_IDENTITY_UUID }}
+          org-project-slug: ${{ secrets.INFISICAL_ORG_PROJECT_SLUG }}
+          repo-identity-id: ${{ secrets.INFISICAL_REPO_IDENTITY_UUID }}
+          repo-project-slug: ${{ secrets.INFISICAL_REPO_PROJECT_SLUG }}
+          env-slug: prod
+          required-keys: FACTORY_API_KEY
+
       - name: Prepare working branch
         shell: bash
         env:
@@ -679,7 +690,7 @@ jobs:
         shell: bash
         env:
           DEFAULT_BRANCH: ${{ needs.droid-context.outputs.default_branch }}
-          FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
+          FACTORY_API_KEY: ${{ env.FACTORY_API_KEY }}
         run: |
           set -euo pipefail
           test -n "${FACTORY_API_KEY:-}"
@@ -695,7 +706,7 @@ jobs:
         shell: bash
         env:
           DROID_PROMPT_PATH: ${{ steps.prepare.outputs.prompt_path }}
-          FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
+          FACTORY_API_KEY: ${{ env.FACTORY_API_KEY }}
         run: |
           set -euo pipefail
           factory_key_value="${FACTORY_API_KEY:?FACTORY_API_KEY is required}"
diff --git a/.github/workflows/droid-review.yml b/.github/workflows/droid-review.yml
index c527a60..26e54b5 100644
--- a/.github/workflows/droid-review.yml
+++ b/.github/workflows/droid-review.yml
@@ -214,10 +214,20 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Fetch secrets from Infisical
+        uses: WriterInternal/devops-github-actions/infisical-secrets@2b7c38445cb1b9c43f88d7ec990ccb1534078ae8 # v2.4.0
+        with:
+          org-identity-id: ${{ secrets.INFISICAL_ORG_IDENTITY_UUID }}
+          org-project-slug: ${{ secrets.INFISICAL_ORG_PROJECT_SLUG }}
+          repo-identity-id: ${{ secrets.INFISICAL_REPO_IDENTITY_UUID }}
+          repo-project-slug: ${{ secrets.INFISICAL_REPO_PROJECT_SLUG }}
+          env-slug: prod
+          required-keys: FACTORY_API_KEY
+
       - name: Run Droid Auto Review
         uses: Factory-AI/droid-action@150e8c231191631016a9563bf5d8388e36382de9 # main
         with:
-          factory_api_key: ${{ secrets.FACTORY_API_KEY }}
+          factory_api_key: ${{ env.FACTORY_API_KEY }}
           github_token: ${{ github.token }}
           automatic_review: true
           automatic_security_review: true
diff --git a/.github/workflows/droid.yml b/.github/workflows/droid.yml
index 2b34f01..bf590f3 100644
--- a/.github/workflows/droid.yml
+++ b/.github/workflows/droid.yml
@@ -132,11 +132,22 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Fetch secrets from Infisical
+        if: steps.target.outputs.should_run == 'true'
+        uses: WriterInternal/devops-github-actions/infisical-secrets@2b7c38445cb1b9c43f88d7ec990ccb1534078ae8 # v2.4.0
+        with:
+          org-identity-id: ${{ secrets.INFISICAL_ORG_IDENTITY_UUID }}
+          org-project-slug: ${{ secrets.INFISICAL_ORG_PROJECT_SLUG }}
+          repo-identity-id: ${{ secrets.INFISICAL_REPO_IDENTITY_UUID }}
+          repo-project-slug: ${{ secrets.INFISICAL_REPO_PROJECT_SLUG }}
+          env-slug: prod
+          required-keys: FACTORY_API_KEY
+
       - name: Run Droid Exec
         if: steps.target.outputs.should_run == 'true'
         uses: Factory-AI/droid-action@150e8c231191631016a9563bf5d8388e36382de9 # main
         with:
-          factory_api_key: ${{ secrets.FACTORY_API_KEY }}
+          factory_api_key: ${{ env.FACTORY_API_KEY }}
           review_model: claude-sonnet-4-6
           security_model: gpt-5.4
           reasoning_effort: high
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc0b0bd..d7f9454 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
       - id: meta
         shell: bash
         env:
-          INPUT_TAG: ${{ github.event.inputs.image_tag || '' }}
+          INPUT_TAG: ${{ github.event.inputs['image_tag'] || '' }}
         run: |
           set -euo pipefail
           if [ -n "${INPUT_TAG}" ]; then tag="${INPUT_TAG}"; else tag="${GITHUB_REF_NAME}"; fi
@@ -68,6 +68,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [image]
     if: startsWith(needs.image.outputs.image_tag, 'v')
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -75,11 +78,20 @@ jobs:
           - target_environment: sec-dev
           - target_environment: go-prod
     steps:
+      - name: Fetch secrets from Infisical
+        uses: WriterInternal/devops-github-actions/infisical-secrets@2b7c38445cb1b9c43f88d7ec990ccb1534078ae8 # v2.4.0
+        with:
+          org-identity-id: ${{ secrets.INFISICAL_ORG_IDENTITY_UUID }}
+          org-project-slug: ${{ secrets.INFISICAL_ORG_PROJECT_SLUG }}
+          repo-identity-id: ${{ secrets.INFISICAL_REPO_IDENTITY_UUID }}
+          repo-project-slug: ${{ secrets.INFISICAL_REPO_PROJECT_SLUG }}
+          env-slug: prod
+          required-keys: APERIO_INFRA_PROMOTION_TOKEN APERIO_INFRA_REPOSITORY
       - name: Dispatch release deployment request
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.APERIO_INFRA_PROMOTION_TOKEN }}
-          INFRA_REPOSITORY: ${{ secrets.APERIO_INFRA_REPOSITORY }}
+          GH_TOKEN: ${{ env.APERIO_INFRA_PROMOTION_TOKEN }}
+          INFRA_REPOSITORY: ${{ env.APERIO_INFRA_REPOSITORY }}
           IMAGE_TAG: ${{ needs.image.outputs.image_tag }}
           IMAGE_DIGEST: ${{ needs.image.outputs.image_digest }}
           TARGET_ENVIRONMENT: ${{ matrix.target_environment }}