diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c21c2be..33e5c87 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,11 +2,7 @@ name: "CI"
 
 on:
   push:
-    branches:
-      - "main"
   pull_request:
-    branches:
-      - "main"
   workflow_dispatch:
 
 permissions:
@@ -24,11 +20,13 @@ jobs:
     steps:
       - name: "git checkout"
         uses: "actions/checkout@v7"
+        with:
+          persist-credentials: false
       - name: "Validate composer.json"
         run: "composer validate --strict"
 
   php:
-    name: "PHP ${{ matrix.php-version }}"
+    name: "PHP ${{ matrix.php-version }} (${{ matrix.dependencies }})"
     needs: "composer"
     runs-on: "ubuntu-latest"
     timeout-minutes: 15
@@ -39,62 +37,34 @@ jobs:
           - "8.1"
           - "8.2"
           - "8.3"
+        dependencies:
+          - "locked"
+        include:
+          - php-version: "8.1"
+            dependencies: "lowest"
     steps:
       - name: "git checkout"
         uses: "actions/checkout@v7"
+        with:
+          persist-credentials: false
       - name: "setup PHP"
         uses: "shivammathur/setup-php@v2"
         with:
           php-version: "${{ matrix.php-version }}"
           extensions: "json"
-          coverage: "xdebug"
           tools: "composer:v2"
-          cache: "composer"
-      - name: "check PHP version"
-        run: "php -v"
+      - name: "install composer dependencies (locked)"
+        if: "matrix.dependencies == 'locked'"
+        run: "composer install --prefer-dist --no-interaction --no-progress"
+      - name: "install composer dependencies (lowest)"
+        if: "matrix.dependencies == 'lowest'"
+        run: "composer update --prefer-lowest --prefer-dist --no-interaction --no-progress"
+      - name: "audit dependencies for known security vulnerabilities"
+        if: "matrix.php-version == '8.1'"
+        run: "composer audit"
       - name: "lint PHP files"
         run: "find src -type f -name '*.php' -print0 | xargs -0 -n1 php -l"
-      - name: "install composer dependencies"
-        run: "composer install --prefer-dist --no-interaction --no-progress"
-
-  phpstan:
-    name: "PHPStan"
-    needs: "composer"
-    runs-on: "ubuntu-latest"
-    timeout-minutes: 15
-    steps:
-      - name: "git checkout"
-        uses: "actions/checkout@v7"
-      - name: "setup PHP"
-        uses: "shivammathur/setup-php@v2"
-        with:
-          php-version: "8.3"
-          extensions: "json"
-          tools: "composer:v2"
-          cache: "composer"
-      - name: "install composer dependencies"
-        run: "composer install --prefer-dist --no-interaction --no-progress"
-      - name: "PHPStan static analysis"
-        run: "vendor/bin/phpstan analyse --configuration=phpstan.neon"
-
-  codesniffer:
-    name: "PHP CodeSniffer"
-    needs: "composer"
-    runs-on: "ubuntu-latest"
-    timeout-minutes: 15
-    steps:
-      - name: "git checkout"
-        uses: "actions/checkout@v7"
-      - name: "setup PHP"
-        uses: "shivammathur/setup-php@v2"
-        with:
-          php-version: "8.3"
-          extensions: "json"
-          tools: "composer:v2"
-          cache: "composer"
-      - name: "install composer dependencies"
-        run: "composer install --prefer-dist --no-interaction --no-progress"
-      - name: "check PHP_CodeSniffer version"
-        run: "vendor/bin/phpcs --version"
-      - name: "PHP CodeSniffer"
-        run: "vendor/bin/phpcs"
+      - name: "run PHPStan"
+        run: "php vendor/bin/phpstan analyse --no-progress"
+      - name: "run PHPCS"
+        run: "php vendor/bin/phpcs"