diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 624a9f2..84bbd9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,72 +12,19 @@ concurrency:
 
 permissions:
   contents: read
+  # required by go-ci.yml's gosec SARIF upload
+  security-events: write
 
 jobs:
   # ─── Go Build & Test ────────────────────────────────────────────────
-  go:
-    name: Go
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        go-version: ["1.25.7"]
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v6
-        with:
-          go-version: ${{ matrix.go-version }}
-          cache: true
-          cache-dependency-path: go.sum
-
-      - name: Download modules
-        run: go mod download
-
-      - name: Verify module tidy
-        run: |
-          go mod tidy
-          git diff --exit-code go.mod go.sum
-
-      - name: Build
-        run: go build ./...
-
-      - name: Test
-        run: go test -race -count=1 -coverprofile=coverage.out ./...
-
-      - name: Upload coverage
-        if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v6
-        with:
-          name: coverage-go${{ matrix.go-version }}
-          path: coverage.out
-          retention-days: 7
-
-  # ─── Lint ───────────────────────────────────────────────────────────
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    needs: go
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: "1.25.7"
-          cache: true
-          cache-dependency-path: go.sum
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: latest
-          args: --timeout 10m
+  # test, lint, verify and security via the shared workflow. The Makefile has
+  # no test/lint/vet targets, so its probe falls back to the plain go commands
+  # this job used to run directly.
+  ci:
+    uses: xraph/workflows/.github/workflows/go-ci.yml@v1
+    with:
+      go-versions: '["1.25"]'
+      os: '["ubuntu-latest"]'
 
   # ─── Format Check ──────────────────────────────────────────────────
   format:
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f652cef
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+
+# Local git worktrees
+.worktrees/