diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index fbd369f5..55a65621 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -42,3 +42,5 @@ jobs:
           file: build/fpm.Dockerfile
           push: true
           tags: ghcr.io/${{ github.repository_owner }}/fpm:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/repos.yml b/.github/workflows/repos.yml
index 81387ed2..af2ef943 100644
--- a/.github/workflows/repos.yml
+++ b/.github/workflows/repos.yml
@@ -15,6 +15,10 @@ jobs:
 
     if: github.event.workflow_run.conclusion == 'success'
 
+    permissions:
+      contents: write
+      actions: read
+
     steps:
 
       - name: Checkout code
@@ -22,22 +26,25 @@ jobs:
         with:
           lfs: true
 
-      # Install `2.22.35` until AWS S3 SDK compatibility inconsistencies
-      # with R2 are resolved: https://www.cloudflarestatus.com/
-      - name: Install AWS CLI
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2.22.35
-
+      # Uses AWS CLI preinstalled on ubuntu-latest runners.
       - name: Download artifacts
-        uses: dawidd6/action-download-artifact@v21
-        with:
-          workflow: ${{ github.event.workflow.id }}
-          run_id: ${{ github.event.workflow_run.id }}
-          path: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh run download ${{ github.event.workflow_run.id }} --dir artifacts
 
       - name: Get build tag
-        run: echo "TAG=$(find artifacts -name 'TAG' | head -n 1 | xargs cat)" >> $GITHUB_ENV
+        run: |
+          TAG_FILE=$(find artifacts -name 'TAG' | head -n 1)
+          if [ -z "$TAG_FILE" ]; then
+            echo "No TAG file found in downloaded artifacts" >&2
+            exit 1
+          fi
+          TAG=$(tr -d '[:space:]' < "$TAG_FILE")
+          if [ -z "$TAG" ]; then
+            echo "TAG file is empty in downloaded artifacts" >&2
+            exit 1
+          fi
+          echo "TAG=$TAG" >> $GITHUB_ENV
 
       - name: Copy packages
         run: |
@@ -105,6 +112,10 @@ jobs:
 
     if: github.event.workflow_run.conclusion == 'success'
 
+    permissions:
+      contents: write
+      actions: read
+
     steps:
 
       - name: Checkout code
@@ -112,22 +123,25 @@ jobs:
         with:
           lfs: true
 
-      # Install `2.22.35` until AWS S3 SDK compatibility inconsistencies
-      # with R2 are resolved: https://www.cloudflarestatus.com/
-      - name: Install AWS CLI
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2.22.35
-
+      # Uses AWS CLI preinstalled on ubuntu-latest runners.
       - name: Download artifacts
-        uses: dawidd6/action-download-artifact@v21
-        with:
-          workflow: ${{ github.event.workflow.id }}
-          run_id: ${{ github.event.workflow_run.id }}
-          path: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh run download ${{ github.event.workflow_run.id }} --dir artifacts
 
       - name: Get build tag
-        run: echo "TAG=$(find artifacts -name 'TAG' | head -n 1 | xargs cat)" >> $GITHUB_ENV
+        run: |
+          TAG_FILE=$(find artifacts -name 'TAG' | head -n 1)
+          if [ -z "$TAG_FILE" ]; then
+            echo "No TAG file found in downloaded artifacts" >&2
+            exit 1
+          fi
+          TAG=$(tr -d '[:space:]' < "$TAG_FILE")
+          if [ -z "$TAG" ]; then
+            echo "TAG file is empty in downloaded artifacts" >&2
+            exit 1
+          fi
+          echo "TAG=$TAG" >> $GITHUB_ENV
 
       - name: Copy packages
         run: |
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 01511365..e56106b5 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -20,13 +20,7 @@ jobs:
         with:
           lfs: true
 
-      # Install `2.22.35` until AWS S3 SDK compatibility inconsistencies
-      # with R2 are resolved: https://www.cloudflarestatus.com/
-      - name: Install AWS CLI
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2.22.35
-
+      # Uses AWS CLI preinstalled on ubuntu-latest runners.
       - name: Sync repo with R2
         env:
           R2_ENDPOINT: https://a1220fd38ad4771f7b7b38f5f3c2b00d.r2.cloudflarestorage.com
@@ -62,13 +56,7 @@ jobs:
         with:
           lfs: true
 
-      # Install `2.22.35` until AWS S3 SDK compatibility inconsistencies
-      # with R2 are resolved: https://www.cloudflarestatus.com/
-      - name: Install AWS CLI
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2.22.35
-
+      # Uses AWS CLI preinstalled on ubuntu-latest runners.
       - name: Sync repo with R2
         env:
           R2_ENDPOINT: https://a1220fd38ad4771f7b7b38f5f3c2b00d.r2.cloudflarestorage.com