diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ce0844c..d864111 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,10 +6,20 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
 
   # Maintain dependencies for Composer
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
+    groups:
+      composer:
+        patterns: ["*"]
     versioning-strategy: increase-if-necessary
diff --git a/.github/linters/.codespellrc b/.github/linters/.codespellrc
index 1375eee..303604d 100644
--- a/.github/linters/.codespellrc
+++ b/.github/linters/.codespellrc
@@ -1,2 +1,2 @@
 [codespell]
-skip = */tests/*,tests/**,*/composer.lock,*/composer.json
+skip = ./.git,.claude/*,.codex/*,.vscode/*,code_coverage/*,composer.lock,runtime/*,scaffold-lock.json,vendor/*,*/tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*
diff --git a/.github/linters/.editorconfig-checker.json b/.github/linters/.editorconfig-checker.json
index bb0f71a..0e57707 100644
--- a/.github/linters/.editorconfig-checker.json
+++ b/.github/linters/.editorconfig-checker.json
@@ -1,5 +1,10 @@
 {
     "Exclude": [
+        "^\\.claude/",
+        "^\\.codex/",
+        "^\\.vscode/",
+        "^code_coverage/",
+        "^composer\\.lock$",
         "phpstan-baseline\\.neon$",
         "^tests/runtime/",
         "\\.min\\.css$",
diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml
index 08ac9fb..1f08510 100644
--- a/.github/linters/.gitleaks.toml
+++ b/.github/linters/.gitleaks.toml
@@ -2,9 +2,3 @@ title = "gitleaks config"
 
 [extend]
 useDefault = true
-
-[allowlist]
-description = "Allow test fixture data with dummy credentials"
-paths = [
-    '''tests/support/data/.*\.php''',
-]
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
deleted file mode 100644
index 7b46557..0000000
--- a/.github/workflows/linter.yml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-on:
-  - pull_request
-  - push
-
-name: linter
-
-permissions:
-  checks: write
-  contents: read
-  statuses: write
-
-jobs:
-  linter:
-    uses: yii2-framework/actions/.github/workflows/super-linter.yml@v1
-    secrets:
-      AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
new file mode 100644
index 0000000..a8802f7
--- /dev/null
+++ b/.github/workflows/quality.yml
@@ -0,0 +1,24 @@
+---
+on:
+  - pull_request
+  - push
+
+name: quality
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    uses: yii2-framework/actions/.github/workflows/quality.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      codespell-config: .github/linters/.codespellrc
+      editorconfig-checker-config: .github/linters/.editorconfig-checker.json
+      markdownlint-config: .github/linters/.markdown-lint.yml
+      prettier-config: .prettierrc.json
+      prettier-ignore-path: .prettierignore
+      yamllint-targets: |-
+        .github
+        metadata/.github
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..8d212d1
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,19 @@
+---
+on:
+  - pull_request
+  - push
+
+name: security
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    uses: yii2-framework/actions/.github/workflows/security.yml@e02758a41a2a811fb3e706735192979171b2260d # v2.0.1
+    permissions:
+      contents: read
+    with:
+      gitleaks-config: .github/linters/.gitleaks.toml
+    secrets:
+      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
diff --git a/.gitignore b/.gitignore
index 848ddae..f61924a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
+# AI agents (if present)
+.codex
+.claude
+
 # codecoverage (if present)
 code_coverage
 
diff --git a/.prettierignore b/.prettierignore
new file mode 100644
index 0000000..a5c42e5
--- /dev/null
+++ b/.prettierignore
@@ -0,0 +1,32 @@
+# Local agent, editor, coverage output, runtime state, caches, and dependencies.
+.claude/**
+.codex/**
+.vscode/**
+code_coverage/**
+runtime/**
+vendor/**
+
+# Dependency lockfile ignored by git.
+composer.lock
+
+**/*.min.css
+**/*.min.js
+
+# Vite-built bundles (committed dist/) and lockfiles.
+**/dist/**
+**/node_modules/**
+**/package-lock.json
+
+# Yii AssetManager publishes a hashed copy of src/assets/ under tests/runtime/
+# whenever phpunit runs; the tree is regenerated on every test run, never
+# authored, and ignored by git already.
+tests/runtime/**
+
+# License texts ship verbatim — never auto-formatted.
+**/LICENSE*
+
+# Tool configs maintained by hand to keep their array order meaningful.
+composer-require-checker.json
+
+# Auto-generated by yii2-extensions/scaffold; never hand-edited.
+scaffold-lock.json
diff --git a/.prettierrc.json b/.prettierrc.json
new file mode 100644
index 0000000..c9f33af
--- /dev/null
+++ b/.prettierrc.json
@@ -0,0 +1,22 @@
+{
+    "tabWidth": 4,
+    "useTabs": false,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 80,
+    "overrides": [
+        {
+            "files": ["**/*.{yml,yaml}"],
+            "options": {
+                "tabWidth": 2
+            }
+        },
+        {
+            "files": "**/*.md",
+            "options": {
+                "embeddedLanguageFormatting": "off",
+                "tabWidth": 2
+            }
+        }
+    ]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c851f2..e6cda73 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## 0.1.3 Under development
 
+- ci: replace Super-Linter with reusable quality and security workflows, group Dependabot updates, and refresh scaffolded linter and Gitleaks configs.
+
 ## 0.1.2 May 19, 2026
 
 - fix: remove `phpunit.xml` from `.gitignore` and update `composer-require-checker.json` structure.
diff --git a/README.md b/README.md
index d024c5d..55e055c 100644
--- a/README.md
+++ b/README.md
@@ -39,7 +39,7 @@ Then run `composer update`.
 ## Scaffolded distribution
 
 This package is a [`yii2-extensions/scaffold`](https://github.com/yii2-extensions/scaffold) provider for **dev
-environment metadata** (editor, gitignore, prettier, stylelint, super-linter configs, and more). Templates live under
+environment metadata** (editor, gitignore, prettier, stylelint, quality linter configs, and more). Templates live under
 `metadata/` and are mapped to consumer roots via the `{from, to}` form in `scaffold.json`.
 
 Opt in by allowing the plugin and listing this package as an authorised provider:
@@ -87,10 +87,9 @@ vendor/bin/scaffold status
 └── .github
     └── linters
         ├── .codespellrc               # replace: codespell config
-        ├── .editorconfig-checker.json # replace: editor-config-checker config for Super-Linter
+        ├── .editorconfig-checker.json # replace: editorconfig-checker config
         ├── .gitleaks.toml             # replace: gitleaks config
-        ├── .markdown-lint.yml         # replace: markdownlint config
-        └── actionlint.yml             # replace: actionlint config for Super-Linter
+        └── .markdown-lint.yml         # replace: markdownlint config
 ```
 
 Mode semantics:
@@ -111,9 +110,10 @@ either, both, or neither.
 [![Latest Stable Version](https://img.shields.io/packagist/v/php-forge/baseline.svg?style=for-the-badge&logo=packagist&logoColor=white&label=Stable)](https://packagist.org/packages/php-forge/baseline)
 [![Total Downloads](https://img.shields.io/packagist/dt/php-forge/baseline.svg?style=for-the-badge&logo=composer&logoColor=white&label=Downloads)](https://packagist.org/packages/php-forge/baseline)
 
-## Quality code
+## Project status
 
-[![Super-Linter](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/linter.yml?style=for-the-badge&label=Super-Linter&logo=github)](https://github.com/php-forge/baseline/actions/workflows/linter.yml)
+[![Quality](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/quality.yml?style=for-the-badge&label=Quality&logo=github)](https://github.com/php-forge/baseline/actions/workflows/quality.yml)
+[![Security](https://img.shields.io/github/actions/workflow/status/php-forge/baseline/security.yml?style=for-the-badge&label=Security&logo=github)](https://github.com/php-forge/baseline/actions/workflows/security.yml)
 [![StyleCI](https://img.shields.io/badge/StyleCI-Passed-44CC11.svg?style=for-the-badge&logo=github&logoColor=white)](https://github.styleci.io/repos/php-forge/baseline?branch=main)
 
 ## Our social networks
diff --git a/composer.json b/composer.json
index f5ccb3e..e95cd7d 100644
--- a/composer.json
+++ b/composer.json
@@ -12,9 +12,9 @@
         "php",
         "php-forge",
         "prettier",
+        "quality",
         "rector",
-        "scaffold-provider",
-        "super-linter"
+        "scaffold-provider"
     ],
     "license": "BSD-3-Clause",
     "minimum-stability": "dev",
diff --git a/metadata/.github/linters/.codespellrc b/metadata/.github/linters/.codespellrc
index bb52ff4..303604d 100644
--- a/metadata/.github/linters/.codespellrc
+++ b/metadata/.github/linters/.codespellrc
@@ -1,2 +1,2 @@
 [codespell]
-skip = */tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*
+skip = ./.git,.claude/*,.codex/*,.vscode/*,code_coverage/*,composer.lock,runtime/*,scaffold-lock.json,vendor/*,*/tests/*,tests/**,*/composer.lock,*/composer.json,*/package-lock.json,*/dist/*,*/node_modules/*
diff --git a/metadata/.github/linters/.editorconfig-checker.json b/metadata/.github/linters/.editorconfig-checker.json
index bb0f71a..0e57707 100644
--- a/metadata/.github/linters/.editorconfig-checker.json
+++ b/metadata/.github/linters/.editorconfig-checker.json
@@ -1,5 +1,10 @@
 {
     "Exclude": [
+        "^\\.claude/",
+        "^\\.codex/",
+        "^\\.vscode/",
+        "^code_coverage/",
+        "^composer\\.lock$",
         "phpstan-baseline\\.neon$",
         "^tests/runtime/",
         "\\.min\\.css$",
diff --git a/metadata/.github/linters/.gitleaks.toml b/metadata/.github/linters/.gitleaks.toml
index 08ac9fb..1f08510 100644
--- a/metadata/.github/linters/.gitleaks.toml
+++ b/metadata/.github/linters/.gitleaks.toml
@@ -2,9 +2,3 @@ title = "gitleaks config"
 
 [extend]
 useDefault = true
-
-[allowlist]
-description = "Allow test fixture data with dummy credentials"
-paths = [
-    '''tests/support/data/.*\.php''',
-]
diff --git a/metadata/.github/linters/actionlint.yml b/metadata/.github/linters/actionlint.yml
deleted file mode 100644
index 328407a..0000000
--- a/metadata/.github/linters/actionlint.yml
+++ /dev/null
@@ -1,6 +0,0 @@
----
-paths:
-  .github/workflows/**/*.yml:
-    ignore:
-      - '"pull_request" section is alias node but mapping node is expected'
-      - '"push" section is alias node but mapping node is expected'
diff --git a/metadata/.prettierignore b/metadata/.prettierignore
index 1886a83..37e9c50 100644
--- a/metadata/.prettierignore
+++ b/metadata/.prettierignore
@@ -1,21 +1,21 @@
-**/*.min.css
-**/*.min.js
+# Local agent, editor, coverage, and generated runtime state.
+.claude/**
+.codex/**
+.vscode/**
+code_coverage/**
+runtime/**
 
-# Vite-built bundles (committed dist/) and lockfiles.
-**/dist/**
-**/node_modules/**
-**/package-lock.json
+# Dependencies.
+vendor/**
 
-# Yii AssetManager publishes a hashed copy of src/assets/ under tests/runtime/
-# whenever phpunit runs; the tree is regenerated on every test run, never
-# authored, and ignored by git already.
-tests/runtime/**
+# Dependency lockfile ignored by git.
+composer.lock
 
-# License texts ship verbatim — never auto-formatted.
+# License texts ship verbatim.
 **/LICENSE*
 
-# Tool configs maintained by hand to keep their array order meaningful.
+# Tool config maintained by hand to keep array order meaningful.
 composer-require-checker.json
 
-# Auto-generated by yii2-extensions/scaffold; never hand-edited.
+# Auto-generated by yii2-extensions/scaffold.
 scaffold-lock.json