diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 83ba38d..210a790 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,22 +5,52 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Node Setup
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18
 
-      - name: PNPM Setup
-        uses: pnpm/action-setup@v2.2.2
+      - name: Setup pinned pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          version: latest
-          run_install: true
-
+          version: 8.15.9
+      - name: Resolve dependency cache
+        id: ci-pnpm-cache
+        shell: bash
+        run: |
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+      - name: Export temporary AWS cache credentials
+        shell: bash
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process']))
+          with open(os.environ['GITHUB_ENV'], 'a') as output:
+              for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]:
+                  value = credentials[source]
+                  if not value or '\n' in value or '\r' in value:
+                      raise RuntimeError('Invalid temporary credential value')
+                  print('::add-mask::' + value)
+                  output.write(target + '=' + value + '\n')
+          PYTHON
+      - name: Restore pnpm download store from S3
+        uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9
+        with:
+          region: us-west-1
+          bucket: stellaraf-public-ci-961341522852-us-west-1
+          path: ${{ steps.ci-pnpm-cache.outputs.path }}
+          key:
+            cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{
+            hashFiles('pnpm-lock.yaml') }}
+          use-fallback: false
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Build
         run: pnpm run build
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 3ddc407..269dc67 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -5,23 +5,53 @@ jobs:
   quality:
     name: Quality
 
-    runs-on: ubuntu-latest
+    runs-on: codebuild-stellaraf-actions-public-${{ github.run_id }}-${{ github.run_attempt }}
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Node Setup
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18
 
-      - name: PNPM Setup
-        uses: pnpm/action-setup@v2.2.2
+      - name: Setup pinned pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         with:
-          version: latest
-          run_install: true
-
+          version: 8.15.9
+      - name: Resolve dependency cache
+        id: ci-pnpm-cache
+        shell: bash
+        run: |
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+          echo "node=$(node --version)" >> "$GITHUB_OUTPUT"
+      - name: Export temporary AWS cache credentials
+        shell: bash
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          credentials = json.loads(subprocess.check_output(['aws', 'configure', 'export-credentials', '--format', 'process']))
+          with open(os.environ['GITHUB_ENV'], 'a') as output:
+              for source, target in [('AccessKeyId', 'AWS_ACCESS_KEY_ID'), ('SecretAccessKey', 'AWS_SECRET_ACCESS_KEY'), ('SessionToken', 'AWS_SESSION_TOKEN')]:
+                  value = credentials[source]
+                  if not value or '\n' in value or '\r' in value:
+                      raise RuntimeError('Invalid temporary credential value')
+                  print('::add-mask::' + value)
+                  output.write(target + '=' + value + '\n')
+          PYTHON
+      - name: Restore pnpm download store from S3
+        uses: tespkg/actions-cache@e07e2d4953dc8c020d447363e5064e36d04f3cf9
+        with:
+          region: us-west-1
+          bucket: stellaraf-public-ci-961341522852-us-west-1
+          path: ${{ steps.ci-pnpm-cache.outputs.path }}
+          key:
+            cache/${{ github.repository }}/${{ github.ref }}/pnpm-8.15.9/${{ runner.os }}/${{ runner.arch }}/${{ steps.ci-pnpm-cache.outputs.node }}/${{
+            hashFiles('pnpm-lock.yaml') }}
+          use-fallback: false
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
       - name: Formatting
         run: pnpm run format