diff --git a/.github/renovate.json b/.github/renovate.json
index 5db72dd..3b65103 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,6 +1,23 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:base",
+    "default:automergeDigest",
+    "helpers:pinGitHubActionDigestsToSemver"
+  ],
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
+  "packageRules": [
+    {
+      "description": "Automerge non-major Go module updates when checks pass",
+      "matchManagers": ["gomod"],
+      "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+      "automerge": true
+    },
+    {
+      "description": "Automerge GitHub Actions updates, including majors, when checks pass",
+      "matchManagers": ["github-actions"],
+      "automerge": true
+    }
   ]
 }
diff --git a/.github/workflows/codetests.yml b/.github/workflows/codetests.yml
index 2ab3ced..70350b8 100644
--- a/.github/workflows/codetests.yml
+++ b/.github/workflows/codetests.yml
@@ -1,23 +1,60 @@
 name: test-and-lint
-on: push
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
 permissions:
   contents: read
 jobs:
+  # Runs `go test` against 3 operating systems.
   gotest:
     strategy:
       matrix:
-        os: [ubuntu, macos]
+        os: [macos, windows, ubuntu]
     runs-on: ${{ matrix.os }}-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version-file: 'go.mod'
-      - name: go-generate
-        run: go generate ./...
+          go-version-file: go.mod
       - name: go-test
-        run: go test ./pkg/...
+        run: go test -race -covermode=atomic '-test.v' ./...
+  # Runs golangci-lint on macos against freebsd and macos.
+  golangci-darwin:
+    strategy:
+      matrix:
+        os: [darwin, freebsd]
+    name: golangci-lint
+    runs-on: macos-latest
+    env:
+      GOOS: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          version: v2.13
+  # Runs golangci-lint on linux against linux and windows.
+  golangci-linux:
+    strategy:
+      matrix:
+        os: [windows, linux]
+    name: golangci-lint
+    runs-on: ubuntu-latest
+    env:
+      GOOS: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: 'v2.13'
+          version: v2.13