diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..14f07fc
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,98 @@
+# yaml-language-server: $schema=https://storage.googleapis.com/coderabbit_public_assets/schema.v2.json
+language: en-US
+
+# Under 250 characters, the schema's limit.
+tone_instructions: >-
+  Name the trigger, the code path, and the consequence for a caller for every
+  finding. If you cannot name one, do not raise it. No praise, no preamble, no
+  restating the diff.
+
+reviews:
+  profile: assertive
+  poem: false
+  in_progress_fortune: false
+
+  auto_review:
+    enabled: true
+    drafts: false
+
+  high_level_summary_instructions: |
+    Write in present tense. Lead with what changes for a calling repository,
+    not with the file list. Do not restate the PR description.
+
+  pre_merge_checks:
+    # Quoted: bare `off` is a YAML 1.1 boolean, and this field takes a string.
+    docstrings:
+      mode: "off"
+    description:
+      mode: "off"
+
+  tools:
+    # ci.yml runs actionlint and shellcheck with this repository's settings.
+    actionlint:
+      enabled: false
+    shellcheck:
+      enabled: false
+    markdownlint:
+      enabled: false
+    languagetool:
+      enabled: false
+
+  path_instructions:
+    - path: "**/*"
+      instructions: |
+        ## Project rules
+        AGENTS.md defines the caller interface, the frozen legacy workflows,
+        the versioning policy and the privacy rule. Flag a change that breaks
+        one of them.
+
+        ## Ref pinning
+        Flag anything in a reusable workflow that resolves files, scripts or
+        nested workflows from `main` or from the caller instead of from the
+        pinned revision. `github.workflow_*` describes the calling workflow;
+        `job.workflow_*` describes the reusable workflow file.
+
+        ## Evaluation traps
+        Flag a reference to a context property that does not exist: it
+        evaluates to an empty string without an error. Flag a `run:` step
+        whose pipeline can hide a failure: without an explicit `shell:`,
+        steps run as `bash -e {0}` without pipefail. Flag a job-level
+        concurrency group that can equal a caller's workflow-level group,
+        which deadlocks the run.
+
+        ## Defaults
+        Hat Labs-specific behaviour belongs in callers' inputs, not in
+        defaults here. Flag a default that favours one organisation.
+
+        ## Comments
+        A comment explains why the code is the way it is, never what changed.
+        Flag comments that narrate the change or restate the code.
+
+        ## Do not ask for these
+        - A VERSION bump or a CHANGELOG. Releases are created by hand as
+          GitHub releases.
+        - SHA-pinning third-party actions. It is out of scope.
+        - A test that runs a reusable workflow from this repository. That is
+          not possible; changes are verified from a caller's run, reported in
+          the PR description.
+
+    - path: "tests/**"
+      instructions: |
+        Tests extract workflow steps and run them against throwaway git
+        repositories with fake tool shims in `tests/lib/`. Flag a test that
+        cannot fail when the step it covers is broken.
+
+    - path: "examples/**"
+      instructions: |
+        Examples are copied into calling repositories. `examples/deb` and
+        `examples/npm` show the v1 interface: flag a call to a legacy workflow
+        or an `@main` pin there, and a `pr.yml` whose `status` job does not
+        need every other job. `examples/cockpit-apt` shows the legacy
+        workflows and `examples/docs-repo` still pins `@main` until the v1
+        documentation work in issue 54 replaces them; do not flag either.
+
+knowledge_base:
+  code_guidelines:
+    enabled: true
+    filePatterns:
+      - AGENTS.md
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 6241444..6dd5ba2 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,6 +1,7 @@
+# actionlint 1.7.12 predates the job.workflow_* context properties. The pattern
+# names the job context's object type so other contexts still fail. Remove it
+# when ACTIONLINT_VERSION in ci.yml reaches a release that knows them.
 paths:
   .github/workflows/check-image-updates.yml:
     ignore:
-      # The property does not exist; remove with the fix for
-      # https://github.com/halos-org/shared-workflows/issues/58
-      - 'property "job_workflow_sha" is not defined'
+      - 'property "workflow_(repository|sha)" is not defined in object type \{check_run_id: '
diff --git a/.github/workflows/check-image-updates.yml b/.github/workflows/check-image-updates.yml
index 4dc444f..6924949 100644
--- a/.github/workflows/check-image-updates.yml
+++ b/.github/workflows/check-image-updates.yml
@@ -39,15 +39,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      # job_workflow_sha is the commit of *this* reusable workflow file, so the
-      # scripts come from the same revision the caller pinned. github.workflow_ref
-      # names the calling workflow instead, which resolves against the wrong repo
-      # and only appeared to work because both sides have a `main`.
+      # job.workflow_* describe this reusable workflow file, so the scripts come
+      # from the revision the caller pinned. The github.workflow_* properties
+      # describe the calling workflow instead.
       - name: Checkout shared scripts
         uses: actions/checkout@v4
         with:
-          repository: halos-org/shared-workflows
-          ref: ${{ github.job_workflow_sha }}
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
           path: .shared-workflows
           sparse-checkout: scripts