diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e682cff..04bd3da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,85 +7,20 @@ on:
   pull_request:
     branches: ["main"]
 
-# Actions are pinned to commit SHAs (not mutable tags) so a retagged or
-# compromised action version cannot silently enter the pipeline. The trailing
-# comment records the human-readable version each SHA corresponds to.
 jobs:
-  build-and-test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "10.0.x"
-
-      # --locked-mode fails the build if the committed packages.lock.json files
-      # would change, making restores reproducible and tamper-evident.
-      - name: Restore
-        run: dotnet restore --locked-mode
-
-      - name: Restore tools
-        run: dotnet tool restore
-
-      - name: Format check
-        run: dotnet csharpier check .
-
-      - name: Build
-        run: dotnet build --no-restore -c Release
-
-      - name: Test (unit & component)
-        # Exclude the E2E project here — it needs a container runtime + Playwright and runs in
-        # its own workflow. Filtering out every E2E test means its collection fixture never boots.
-        run: dotnet test --no-build -c Release --filter "FullyQualifiedName!~E2ETests"
-
-      # Fail the build on any known-vulnerable package (direct or transitive).
-      - name: Vulnerability scan
-        run: |
-          dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable.txt
-          if grep -qiE '\b(Critical|High|Moderate|Low)\b' vulnerable.txt; then
-            echo "::error::Vulnerable NuGet packages detected (see log above)."
-            exit 1
-          fi
-
-  pack-and-publish:
-    needs: build-and-test
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
-
+  ci:
+    uses: andregoepel/workflows/.github/workflows/ci-library.yml@main
+    with:
+      test-filter: "FullyQualifiedName!~E2ETests"
+      pack-projects: |
+        src/AndreGoepel.AppFoundation.Core/AndreGoepel.AppFoundation.Core.csproj
+        src/AndreGoepel.AppFoundation.ServiceDefaults/AndreGoepel.AppFoundation.ServiceDefaults.csproj
+        src/AndreGoepel.AppFoundation.MailService/AndreGoepel.AppFoundation.MailService.csproj
+        src/AndreGoepel.AppFoundation/AndreGoepel.AppFoundation.csproj
+        src/AndreGoepel.AppFoundation.Hosting/AndreGoepel.AppFoundation.Hosting.csproj
+        src/AndreGoepel.AppFoundation.Aspire/AndreGoepel.AppFoundation.Aspire.csproj
+    secrets:
+      NUGET_USER: ${{ secrets.NUGET_USER }}
     permissions:
-      id-token: write # request the OIDC token for NuGet trusted publishing
+      id-token: write # NuGet OIDC trusted publishing
       contents: read
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Pack
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          for proj in \
-            src/AndreGoepel.AppFoundation.Core/AndreGoepel.AppFoundation.Core.csproj \
-            src/AndreGoepel.AppFoundation.ServiceDefaults/AndreGoepel.AppFoundation.ServiceDefaults.csproj \
-            src/AndreGoepel.AppFoundation.MailService/AndreGoepel.AppFoundation.MailService.csproj \
-            src/AndreGoepel.AppFoundation/AndreGoepel.AppFoundation.csproj \
-            src/AndreGoepel.AppFoundation.Hosting/AndreGoepel.AppFoundation.Hosting.csproj \
-            src/AndreGoepel.AppFoundation.Aspire/AndreGoepel.AppFoundation.Aspire.csproj; do
-            dotnet pack "$proj" -c Release -p:Version=$VERSION -p:RestoreLockedMode=true -o nupkgs
-          done
-
-      # Trusted publishing: exchange the GitHub OIDC token for a short-lived
-      # nuget.org API key. Requires a trusted publishing policy on nuget.org
-      # (owner: andregoepel, repository: app-foundation, workflow: ci.yml).
-      - name: NuGet login (OIDC → temporary API key)
-        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
-        id: login
-        with:
-          user: ${{ secrets.NUGET_USER }}
-
-      - name: Push to NuGet
-        run: dotnet nuget push "nupkgs/*.nupkg" --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 126803e..06cf71f 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -7,27 +7,8 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
-# Actions are pinned to commit SHAs (matching ci.yml) so a retagged or compromised
-# action version cannot silently enter the pipeline.
 jobs:
-  end-to-end:
-    runs-on: ubuntu-latest
-    # GitHub-hosted Linux runners ship with Docker, which Aspire.Hosting.Testing uses to
-    # start the Postgres and MailHog containers for the real end-to-end run.
-    timeout-minutes: 30
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Build E2E project
-        run: dotnet build tests/AndreGoepel.AppFoundation.E2ETests/AndreGoepel.AppFoundation.E2ETests.csproj -c Release
-
-      - name: Install Playwright browsers
-        run: pwsh tests/AndreGoepel.AppFoundation.E2ETests/bin/Release/net10.0/playwright.ps1 install --with-deps chromium
-
-      - name: Run E2E tests
-        run: dotnet test tests/AndreGoepel.AppFoundation.E2ETests/AndreGoepel.AppFoundation.E2ETests.csproj --no-build -c Release
+  e2e:
+    uses: andregoepel/workflows/.github/workflows/e2e.yml@main
+    with:
+      e2e-project: tests/AndreGoepel.AppFoundation.E2ETests/AndreGoepel.AppFoundation.E2ETests.csproj