diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cd096884..a3c5e62f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,11 +11,7 @@ on:
         default: false
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-  packages: write
-  id-token: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
@@ -190,6 +186,8 @@ jobs:
     name: Upload Release Assets
     needs: [release-please, build-binaries]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Generate GitHub App Token
         id: app-token
diff --git a/.github/workflows/security-deep.yml b/.github/workflows/security-deep.yml
index d133ae40..ee767ce8 100644
--- a/.github/workflows/security-deep.yml
+++ b/.github/workflows/security-deep.yml
@@ -11,7 +11,6 @@ concurrency:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   gitleaks-history:
diff --git a/apps/rook/Dockerfile b/apps/rook/Dockerfile
index 36043df6..d3d4c7ee 100644
--- a/apps/rook/Dockerfile
+++ b/apps/rook/Dockerfile
@@ -27,12 +27,10 @@ ARG TARGETARCH
 RUN echo "Target architecture: ${TARGETARCH}"
 COPY rook-${TARGETARCH} /usr/local/bin/rook
 
-# Create config directory with proper permissions
+# Create config directory with proper permissions and ensure binary is executable
 RUN mkdir -p /app/config \
-    && chown -R rook:rook /app
-
-# Ensure binary is executable
-RUN chmod +x /usr/local/bin/rook
+    && chown -R rook:rook /app \
+    && chmod +x /usr/local/bin/rook
 
 USER rook
 
diff --git a/apps/rook/build.rs b/apps/rook/build.rs
index 74d12dc0..2106f291 100644
--- a/apps/rook/build.rs
+++ b/apps/rook/build.rs
@@ -28,16 +28,15 @@ fn main() {
     } else {
         let profile = std::env::var("PROFILE").unwrap_or_default();
         if profile == "release" {
-            eprintln!(
-                "error: dashboard/node_modules/.bin/vite not found in release mode"
-            );
-            eprintln!("hint: run `pnpm install` in the repo root before building release"
-            );
+            eprintln!("error: dashboard/node_modules/.bin/vite not found in release mode");
+            eprintln!("hint: run `pnpm install` in the repo root before building release");
             std::process::exit(1);
         }
         println!(
             "cargo:warning=dashboard/node_modules/.bin/vite not found, skipping dashboard build"
         );
-        println!("cargo:warning=hint: run `pnpm install` in the repo root to enable dashboard embedding");
+        println!(
+            "cargo:warning=hint: run `pnpm install` in the repo root to enable dashboard embedding"
+        );
     }
 }
diff --git a/apps/rook/dashboard/playwright.config.ts b/apps/rook/dashboard/playwright.config.ts
index 5ece9567..8f805e6b 100644
--- a/apps/rook/dashboard/playwright.config.ts
+++ b/apps/rook/dashboard/playwright.config.ts
@@ -1,12 +1,6 @@
 import process from 'node:process'
 import { defineConfig, devices } from '@playwright/test'
 
-/**
- * Read environment variables from file.
- * https://github.com/motdotla/dotenv
- */
-// require('dotenv').config();
-
 /**
  * See https://playwright.dev/docs/test-configuration.
  */
diff --git a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbEllipsis.vue b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbEllipsis.vue
index 9cc3a4f2..41d33d06 100644
--- a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbEllipsis.vue
+++ b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbEllipsis.vue
@@ -9,15 +9,13 @@ const props = defineProps<{
 </script>
 
 <template>
-  <span
+  <li
     data-slot="breadcrumb-ellipsis"
-    role="presentation"
-    aria-hidden="true"
     :class="cn('flex size-9 items-center justify-center', props.class)"
   >
     <slot>
       <MoreHorizontal class="size-4" />
     </slot>
     <span class="sr-only">More</span>
-  </span>
+  </li>
 </template>
diff --git a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbItem.vue b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbItem.vue
index e3dce685..37004943 100644
--- a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbItem.vue
+++ b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbItem.vue
@@ -9,6 +9,7 @@ const props = defineProps<{
 
 <template>
   <li
+    role="listitem"
     data-slot="breadcrumb-item"
     :class="cn('inline-flex items-center gap-1.5', props.class)"
   >
diff --git a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbPage.vue b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbPage.vue
index b429b20c..4a769584 100644
--- a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbPage.vue
+++ b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbPage.vue
@@ -8,13 +8,11 @@ const props = defineProps<{
 </script>
 
 <template>
-  <span
+  <li
     data-slot="breadcrumb-page"
-    role="link"
-    aria-disabled="true"
     aria-current="page"
     :class="cn('text-foreground font-normal', props.class)"
   >
     <slot />
-  </span>
+  </li>
 </template>
diff --git a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbSeparator.vue b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbSeparator.vue
index ef16ef01..d13f5d28 100644
--- a/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbSeparator.vue
+++ b/apps/rook/dashboard/src/components/ui/breadcrumb/BreadcrumbSeparator.vue
@@ -10,8 +10,8 @@ const props = defineProps<{
 
 <template>
   <li
+    role="separator"
     data-slot="breadcrumb-separator"
-    role="presentation"
     aria-hidden="true"
     :class="cn('[&>svg]:size-3.5', props.class)"
   >
diff --git a/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuItem.vue b/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuItem.vue
index e2fda5b4..d36b6454 100644
--- a/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuItem.vue
+++ b/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuItem.vue
@@ -9,6 +9,7 @@ const props = defineProps<{
 
 <template>
   <li
+    role="listitem"
     data-slot="sidebar-menu-item"
     data-sidebar="menu-item"
     :class="cn('group/menu-item relative', props.class)"
diff --git a/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuSubItem.vue b/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuSubItem.vue
index d4374f65..f0528614 100644
--- a/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuSubItem.vue
+++ b/apps/rook/dashboard/src/components/ui/sidebar/SidebarMenuSubItem.vue
@@ -9,6 +9,7 @@ const props = defineProps<{
 
 <template>
   <li
+    role="listitem"
     data-slot="sidebar-menu-sub-item"
     data-sidebar="menu-sub-item"
     :class="cn('group/menu-sub-item relative', props.class)"
diff --git a/apps/rook/dashboard/src/stores/theme.ts b/apps/rook/dashboard/src/stores/theme.ts
index 7f8514cd..b305919a 100644
--- a/apps/rook/dashboard/src/stores/theme.ts
+++ b/apps/rook/dashboard/src/stores/theme.ts
@@ -29,7 +29,7 @@ export const useThemeStore = defineStore('theme', () => {
     const stored = localStorage.getItem('theme') as Theme | null
     if (stored) {
       setTheme(stored)
-    } else if (window.matchMedia('(prefers-color-scheme: dark)').matches) {
+    } else if (globalThis.matchMedia('(prefers-color-scheme: dark)').matches) {
       setTheme('dark')
     }
   }
diff --git a/apps/rook/npm/rook/lib/index.js b/apps/rook/npm/rook/lib/index.js
index dfd383da..a7bd7037 100644
--- a/apps/rook/npm/rook/lib/index.js
+++ b/apps/rook/npm/rook/lib/index.js
@@ -4,15 +4,22 @@
  * Rook launcher - finds the platform-specific binary and executes it
  */
 
-const { execSync } = require('child_process');
-const path = require('path');
-const os = require('os');
+const { execSync } = require('node:child_process');
+const path = require('node:path');
+const os = require('node:os');
 
 const PKG = '@dallay/rook';
 
 function getPlatform() {
   const arch = os.arch() === 'arm64' ? 'arm64' : 'x64';
-  const platform = os.platform() === 'win32' ? 'windows' : os.platform() === 'darwin' ? 'darwin' : 'linux';
+  let platform;
+  if (os.platform() === 'win32') {
+    platform = 'windows';
+  } else if (os.platform() === 'darwin') {
+    platform = 'darwin';
+  } else {
+    platform = 'linux';
+  }
   return `${platform}-${arch}`;
 }
 
@@ -28,7 +35,7 @@ function findBinary() {
     try {
       const globalPath = execSync(`npm root -g`, { encoding: 'utf8' }).trim();
       const globalBinary = path.join(globalPath, platformPkg, 'bin', binaryName);
-      require('fs').accessSync(globalBinary);
+      require('node:fs').accessSync(globalBinary);
       return globalBinary;
     } catch {
       // Last resort: look in PATH