diff --git a/.github/workflows/_static-analysis.yml b/.github/workflows/_static-analysis.yml
index 6ab6f2b9..cf0ab46e 100644
--- a/.github/workflows/_static-analysis.yml
+++ b/.github/workflows/_static-analysis.yml
@@ -10,12 +10,11 @@ jobs:
   static-check:
     name: Run Static Analysis
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.12"]
     steps:
     - uses: actions/checkout@v7
       with:
+        # Betterleaks scans git history across refs, so it needs the full
+        # history rather than the default shallow clone.
         fetch-depth: 0
 
     - name: Run Betterleaks
@@ -25,24 +24,27 @@ jobs:
       uses: dortort/betterleaks-action@cd0b905aa4befb8f42f8b1ab98150180c9e77515
       with:
         version: "v1.9.0"
+        report-path: betterleaks-report.sarif
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Upload Betterleaks report
-      if: always()
       uses: actions/upload-artifact@v7
+      if: always()
       with:
         name: betterleaks-report
-        path: betterleaks-report.sarif
         if-no-files-found: warn
+        path: ${{ steps.betterleaks.outputs.report-path }}
 
     - name: Fail if Betterleaks found leaks
       if: steps.betterleaks.outcome == 'failure'
-      run: exit 1
+      run: |
+        echo "Betterleaks reported a failure in at least one scan."
+        exit 1
 
-    - name: Set up Python ${{ matrix.python-version }}
+    - name: Set up Python
       uses: actions/setup-python@v7
       with:
-        python-version: ${{ matrix.python-version }}
+        python-version: "3.12"
 
     - name: Cache dependencies
       uses: actions/cache@v6
@@ -71,6 +73,6 @@ jobs:
 
     - name: Run all static analysis
       env:
-        SKIP: sphinx-html,sphinx-linkcheck
+        SKIP: betterleaks,sphinx-html,sphinx-linkcheck
       run: |
         prek run --all-files
diff --git a/.github/workflows/_workflow_lint.yml b/.github/workflows/_workflow_lint.yml
deleted file mode 100644
index 0e09112a..00000000
--- a/.github/workflows/_workflow_lint.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Lint workflows
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  actionlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - name: Download actionlint
-        id: get_actionlint
-        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-        shell: bash
-      - name: Run actionlint
-        run: ${{ steps.get_actionlint.outputs.executable }} -color
-        shell: bash
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 617b6eac..f174d414 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   workflow-lint:
-    uses: ./.github/workflows/_workflow_lint.yml
+    uses: mindee/client-lib-actions/.github/workflows/workflow-lint.yml@main
   static-analysis:
     uses: ./.github/workflows/_static-analysis.yml
     needs: workflow-lint