diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml
index 77adda8..d586089 100644
--- a/.github/workflows/R-CMD-check.yaml
+++ b/.github/workflows/R-CMD-check.yaml
@@ -1,3 +1,5 @@
+# Calls the shared CTTIR workflow. Do not add steps here - change the
+# shared one at CTTIR/.github so every package moves together.
 on:
   push:
     branches: [main, master]
@@ -6,43 +8,12 @@ on:
 
 name: R-CMD-check
 
+permissions: read-all
+
 jobs:
   R-CMD-check:
-    runs-on: ${{ matrix.config.os }}
-
-    name: ${{ matrix.config.os }} (${{ matrix.config.r }})
-
-    strategy:
-      fail-fast: false
-      matrix:
-        config:
-          - {os: macos-latest,   r: 'release'}
-          - {os: windows-latest, r: 'release'}
-          - {os: ubuntu-latest,  r: 'devel', http-user-agent: 'release'}
-          - {os: ubuntu-latest,  r: 'release'}
-          - {os: ubuntu-latest,  r: 'oldrel-1'}
-
-    env:
-      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
-      R_KEEP_PKG_SOURCE: yes
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: r-lib/actions/setup-pandoc@v2
-
-      - uses: r-lib/actions/setup-r@v2
-        with:
-          r-version: ${{ matrix.config.r }}
-          http-user-agent: ${{ matrix.config.http-user-agent }}
-          use-public-rspm: true
-
-      - uses: r-lib/actions/setup-r-dependencies@v2
-        with:
-          extra-packages: any::rcmdcheck
-          needs: check
-
-      - uses: r-lib/actions/check-r-package@v2
-        with:
-          upload-snapshots: true
-          args: 'c("--no-manual", "--as-cran")'
+    uses: CTTIR/.github/.github/workflows/R-CMD-check.yaml@main
+    with:
+      # Suggests Bioconductor packages that pak cannot solve without the
+      # Bioconductor repository declared.
+      bioc-repository: true
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 19dddbb..0e59a2c 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -3,30 +3,15 @@ on:
     branches: [main, master]
   pull_request:
     branches: [main, master]
-  workflow_dispatch:
 
 name: lint
 
+permissions: read-all
+
 jobs:
   lint:
-    runs-on: ubuntu-latest
-    env:
-      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
-
-      - uses: r-lib/actions/setup-r-dependencies@v2
-        with:
-          extra-packages: any::lintr, local::.
-          needs: lint
-
-      - name: Lint
-        run: lintr::lint_package()
-        shell: Rscript {0}
-        env:
-          LINTR_ERROR_ON_LINT: true
+    uses: CTTIR/.github/.github/workflows/lint.yaml@main
+    with:
+      # FROZEN package - it underpins manuscripts in press. Every quality
+      # gate is report-only here; only api-lock blocks.
+      blocking: false
diff --git a/.github/workflows/test-coverage.yaml b/.github/workflows/test-coverage.yaml
index c51ca7a..bb19507 100644
--- a/.github/workflows/test-coverage.yaml
+++ b/.github/workflows/test-coverage.yaml
@@ -3,55 +3,17 @@ on:
     branches: [main, master]
   pull_request:
     branches: [main, master]
-  workflow_dispatch:
 
 name: test-coverage
 
+permissions: read-all
+
 jobs:
   test-coverage:
-    runs-on: ubuntu-latest
-    env:
-      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
-
-      - uses: r-lib/actions/setup-r-dependencies@v2
-        with:
-          extra-packages: any::covr
-          needs: coverage
-
-      - name: Test coverage
-        run: |
-          cov <- covr::package_coverage(
-            quiet = FALSE,
-            clean = FALSE,
-            install_path = file.path(normalizePath(Sys.getenv("RUNNER_TEMP"), winslash = "/"), "package")
-          )
-          covr::to_cobertura(cov)
-        shell: Rscript {0}
-
-      - name: Upload coverage to Codecov
-        if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./cobertura.xml
-          fail_ci_if_error: false
-          disable_search: true
-          plugins: noop
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-      - name: Coverage summary (no Codecov token)
-        if: ${{ env.CODECOV_TOKEN == '' }}
-        run: |
-          echo "::warning ::No CODECOV_TOKEN secret set on this repository."
-          echo "Coverage was computed locally but not uploaded to Codecov."
-          echo "Add CODECOV_TOKEN under Settings -> Secrets and variables -> Actions to enable upload."
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    uses: CTTIR/.github/.github/workflows/test-coverage.yaml@main
+    with:
+      # Report-only for now. The shared workflow computes coverage with covr
+      # and an explicit exit rather than delegating the gate to Codecov;
+      # set a real floor once this package is re-baselined.
+      floor: 0
+    secrets: inherit