diff --git a/.github/workflows/affinity-corpus.yml b/.github/workflows/affinity-corpus.yml
index b3e0178f56..c6c130a5ba 100644
--- a/.github/workflows/affinity-corpus.yml
+++ b/.github/workflows/affinity-corpus.yml
@@ -17,25 +17,25 @@ concurrency:
 
 jobs:
   affinity3:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      AFFINITY_CORPUS_REQUIRED: "1"
-      CARGO_PROFILE_DEV_DEBUG: "0"
-      CARGO_PROFILE_TEST_DEBUG: "0"
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install Rust
-        uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
-        with:
-          toolchain: "1.95"
-      - name: Fetch pinned and checksum-verified corpus
-        run: cargo xtask corpus --affinity
-      - name: Parse every file and freeze actual Affinity 3 feature retention
-        run: cargo test -p vectorcraft-affinity --all-features -- --nocapture
-      - name: Check every artboard, native save, SVG, PDF and PSD exports
-        run: cargo test -p vectorcraft-engine --test affinity_artboards --test affinity_text --test affinity_corpus -- --nocapture
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      timeout-minutes: 30
+      toolchain: "1.95"
+      # As before: no craft-fonts, apt packages, wasm target or nextest.
+      craft-fonts-ref: ""
+      targets: ""
+      tools: ""
+      dev-debug: "0"
+      env: |
+        AFFINITY_CORPUS_REQUIRED=1
+        CARGO_PROFILE_TEST_DEBUG=0
+      # Its own cache, apart from ci.yml's gate.
+      cache-version: v1-affinity
+      command: |
+        # Pinned and checksum-verified corpus.
+        cargo xtask corpus --affinity
+        # Parse every file and freeze actual Affinity 3 feature retention.
+        cargo test -p vectorcraft-affinity --all-features -- --nocapture
+        # Every artboard, native save, SVG, PDF and PSD export.
+        cargo test -p vectorcraft-engine --test affinity_artboards --test affinity_text --test affinity_corpus -- --nocapture
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd836de6c7..32043bf033 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,51 +30,9 @@ jobs:
       contents: read
       pull-requests: read
     uses: storytold/craft-common-actions/.github/workflows/refresh-contributors.yml@main
-  git-sources:
-    name: Git dependencies come from storytold
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Git dependencies come from storytold
-        run: |
-          set -euo pipefail
-          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
-          # Source replacement, patches and path overrides in cargo config never show up
-          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
-          # Cargo still reads the legacy .cargo/config.
-          python3 - <<'PY'
-          import os, sys, tomllib
-          for path in (".cargo/config", ".cargo/config.toml"):
-              if not os.path.exists(path):
-                  continue
-              config = tomllib.load(open(path, "rb"))
-              replaced = [name for name, source in config.get("source", {}).items()
-                          if isinstance(source, dict) and "replace-with" in source]
-              if replaced or "patch" in config or "paths" in config:
-                  print(f"{path} replaces, patches or overrides a source")
-                  sys.exit(1)
-          PY
-          # Fails when Cargo.lock is out of date with the manifests.
-          cargo metadata --locked --format-version 1 > /dev/null
-          python3 - <<'PY'
-          import sys, tomllib
-          lock = tomllib.load(open("Cargo.lock", "rb"))
-          bad = sorted({p["source"] for p in lock.get("package", [])
-                        if p.get("source", "").startswith("git+")
-                        and not p["source"].startswith("git+https://github.com/storytold/")})
-          if bad:
-              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
-              sys.exit(1)
-          PY
 
   release:
-    needs: [git-sources, credits]
+    needs: credits
     permissions:
       contents: write
       packages: write