diff --git a/.github/workflows/lambda.yml b/.github/workflows/lambda.yml
index 9c6a819..7b17e9d 100644
--- a/.github/workflows/lambda.yml
+++ b/.github/workflows/lambda.yml
@@ -16,7 +16,7 @@ permissions:
 env:
   AWS_REGION: us-east-1
   IAM_ROLE_ARN_S3: arn:aws:iam::847349463865:role/cplive-core-ue2-public-lambda-artifacts-gha
-  IAM_ROLE_SEESION_NAME: cloudposse/token-rotator/ci
+  IAM_ROLE_SESSION_NAME: cloudposse-token-rotator-ci
   S3_BUCKET: cplive-core-ue2-public-lambda-artifacts
   S3_FOLDER: lambda-github-action-token-rotator
 
@@ -28,7 +28,7 @@ jobs:
       # Setup GHA Dependencies
       ##################################################
       - name: Use Node.js 16.x
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 16.x
 
@@ -40,7 +40,7 @@ jobs:
       # Checkout the repository
       ##################################################
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -70,7 +70,7 @@ jobs:
       ##################################################
       - name: Metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: dummy
           tags: |
@@ -98,7 +98,7 @@ jobs:
           mv "./$FILE_NAME" "$GITHUB_WORKSPACE/$FILE_NAME"
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: us-east-2
           role-to-assume: ${{ env.IAM_ROLE_ARN_S3 }}
diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml
index dd0723d..b9272b7 100644
--- a/.github/workflows/validate-codeowners.yml
+++ b/.github/workflows/validate-codeowners.yml
@@ -4,24 +4,12 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  validate-codeowners:
-    runs-on: ubuntu-latest
-    steps:
-    - name: "Checkout source code at current commit"
-      uses: actions/checkout@v4
-    - uses: mszostok/codeowners-validator@v0.5.0
-      if: github.event.pull_request.head.repo.full_name == github.repository
-      name: "Full check of CODEOWNERS"
-      with:
-        # For now, remove "files" check to allow CODEOWNERS to specify non-existent
-        # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
-        #   checks: "files,syntax,owners,duppatterns"
-        checks: "syntax,owners,duppatterns"
-        # GitHub access token is required only if the `owners` check is enabled
-        github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
-    - uses: mszostok/codeowners-validator@v0.5.0
-      if: github.event.pull_request.head.repo.full_name != github.repository
-      name: "Syntax check of CODEOWNERS"
-      with:
-        checks: "syntax,duppatterns"
+  ci-codeowners:
+    uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main
+    with:
+      is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+    secrets: inherit