diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 6e2780258..4c622b5d7 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -46,9 +46,7 @@ run-name: "Smoke Claude"
 
 jobs:
   activation:
-    needs: pre_activation
-    if: >
-      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id))
+    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -167,8 +165,31 @@ jobs:
         with:
           node-version: '24'
           package-manager-cache: false
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          if [ ! -d "$WORKSPACE_PATH" ]; then
+            echo "Workspace path not found: $WORKSPACE_PATH"
+            exit 1
+          fi
+          if [ ! -x "$NODE_BIN" ]; then
+            echo "Node binary not found: $NODE_BIN"
+            exit 1
+          fi
+          if [ ! -d "/usr/local/bin" ]; then
+            echo "/usr/local/bin is missing"
+            exit 1
+          fi
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Install Claude Code CLI
         run: npm install -g --silent @anthropic-ai/claude-code@2.1.14
       - name: Determine automatic lockdown mode for GitHub MCP server
@@ -1276,45 +1297,6 @@ jobs:
           path: /tmp/gh-aw/threat-detection/detection.log
           if-no-files-found: ignore
 
-  pre_activation:
-    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
-    runs-on: ubuntu-slim
-    permissions:
-      discussions: write
-      issues: write
-      pull-requests: write
-    outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
-    steps:
-      - name: Setup Scripts
-        uses: githubnext/gh-aw/actions/setup@55503f44aef44813947980f65655a67b5ed8702f # v0.37.3
-        with:
-          destination: /opt/gh-aw/actions
-      - name: Add heart reaction for immediate feedback
-        id: react
-        if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || (github.event_name == 'pull_request') && (github.event.pull_request.head.repo.id == github.repository_id)
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REACTION: "heart"
-        with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/add_reaction.cjs');
-            await main();
-      - name: Check team membership for workflow
-        id: check_membership
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REQUIRED_ROLES: admin,maintainer,write
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_membership.cjs');
-            await main();
-
   safe_outputs:
     needs:
       - agent
diff --git a/.github/workflows/smoke-claude.md b/.github/workflows/smoke-claude.md
index f65f474be..a32c7efe1 100644
--- a/.github/workflows/smoke-claude.md
+++ b/.github/workflows/smoke-claude.md
@@ -1,11 +1,12 @@
 ---
 description: Smoke test workflow that validates Claude engine functionality by reviewing recent PRs twice daily
-on: 
+on:
   schedule: every 12h
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened]
   reaction: "heart"
+roles: all
 permissions:
   contents: read
   issues: read
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 0643bea6b..589dd71ce 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -42,9 +42,7 @@ run-name: "Smoke Copilot"
 
 jobs:
   activation:
-    needs: pre_activation
-    if: >
-      (needs.pre_activation.outputs.activated == 'true') && ((github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id))
+    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -172,8 +170,31 @@ jobs:
           
           # Verify installation
           copilot --version
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.10.0
+      - name: Install awf dependencies
+        run: npm ci
+      - name: Build awf
+        run: npm run build
+      - name: Install awf binary (local)
+        run: |
+          WORKSPACE_PATH="${GITHUB_WORKSPACE:-$(pwd)}"
+          NODE_BIN="$(command -v node)"
+          if [ ! -d "$WORKSPACE_PATH" ]; then
+            echo "Workspace path not found: $WORKSPACE_PATH"
+            exit 1
+          fi
+          if [ ! -x "$NODE_BIN" ]; then
+            echo "Node binary not found: $NODE_BIN"
+            exit 1
+          fi
+          if [ ! -d "/usr/local/bin" ]; then
+            echo "/usr/local/bin is missing"
+            exit 1
+          fi
+          sudo tee /usr/local/bin/awf > /dev/null <<EOF
+          #!/bin/bash
+          exec "${NODE_BIN}" "${WORKSPACE_PATH}/dist/cli.js" "\$@"
+          EOF
+          sudo chmod +x /usr/local/bin/awf
       - name: Determine automatic lockdown mode for GitHub MCP server
         id: determine-automatic-lockdown
         env:
@@ -1121,45 +1142,6 @@ jobs:
           path: /tmp/gh-aw/threat-detection/detection.log
           if-no-files-found: ignore
 
-  pre_activation:
-    if: (github.event_name != 'pull_request') || (github.event.pull_request.head.repo.id == github.repository_id)
-    runs-on: ubuntu-slim
-    permissions:
-      discussions: write
-      issues: write
-      pull-requests: write
-    outputs:
-      activated: ${{ steps.check_membership.outputs.is_team_member == 'true' }}
-    steps:
-      - name: Setup Scripts
-        uses: githubnext/gh-aw/actions/setup@55503f44aef44813947980f65655a67b5ed8702f # v0.37.3
-        with:
-          destination: /opt/gh-aw/actions
-      - name: Add eyes reaction for immediate feedback
-        id: react
-        if: github.event_name == 'issues' || github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment' || github.event_name == 'discussion' || github.event_name == 'discussion_comment' || (github.event_name == 'pull_request') && (github.event.pull_request.head.repo.id == github.repository_id)
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REACTION: "eyes"
-        with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/add_reaction.cjs');
-            await main();
-      - name: Check team membership for workflow
-        id: check_membership
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          GH_AW_REQUIRED_ROLES: admin,maintainer,write
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_membership.cjs');
-            await main();
-
   safe_outputs:
     needs:
       - agent
diff --git a/.github/workflows/smoke-copilot.md b/.github/workflows/smoke-copilot.md
index 55beaa081..2ac91554c 100644
--- a/.github/workflows/smoke-copilot.md
+++ b/.github/workflows/smoke-copilot.md
@@ -1,11 +1,12 @@
 ---
 description: Smoke Copilot
-on: 
+on:
   schedule: every 12h
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened]
   reaction: "eyes"
+roles: all
 permissions:
   contents: read
   pull-requests: read
diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
new file mode 100644
index 000000000..8a4bf4b6f
--- /dev/null
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+
+import * as fs from 'fs';
+import * as path from 'path';
+
+const repoRoot = path.resolve(__dirname, '../..');
+const workflowPaths = [
+  path.join(repoRoot, '.github/workflows/smoke-copilot.lock.yml'),
+  path.join(repoRoot, '.github/workflows/smoke-claude.lock.yml'),
+];
+
+// Matches the install step with captured indentation:
+// - "Install awf binary" step at any indent level
+// - run command invoking install_awf_binary.sh with a version
+const installStepRegex =
+  /^(\s*)- name: Install awf binary\n\1\s*run: bash \/opt\/gh-aw\/actions\/install_awf_binary\.sh v[0-9.]+\n/m;
+const installStepRegexGlobal = new RegExp(installStepRegex.source, 'gm');
+
+function buildLocalInstallSteps(indent: string): string {
+  const stepIndent = indent;
+  const runIndent = `${indent}  `;
+  const scriptIndent = `${runIndent}  `;
+
+  return [
+    `${stepIndent}- name: Install awf dependencies`,
+    `${runIndent}run: npm ci`,
+    `${stepIndent}- name: Build awf`,
+    `${runIndent}run: npm run build`,
+    `${stepIndent}- name: Install awf binary (local)`,
+    `${runIndent}run: |`,
+    `${scriptIndent}WORKSPACE_PATH="${'${GITHUB_WORKSPACE:-$(pwd)}'}"`,
+    `${scriptIndent}NODE_BIN="$(command -v node)"`,
+    `${scriptIndent}if [ ! -d "$WORKSPACE_PATH" ]; then`,
+    `${scriptIndent}  echo "Workspace path not found: $WORKSPACE_PATH"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
+    `${scriptIndent}if [ ! -x "$NODE_BIN" ]; then`,
+    `${scriptIndent}  echo "Node binary not found: $NODE_BIN"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
+    `${scriptIndent}if [ ! -d "/usr/local/bin" ]; then`,
+    `${scriptIndent}  echo "/usr/local/bin is missing"`,
+    `${scriptIndent}  exit 1`,
+    `${scriptIndent}fi`,
+    `${scriptIndent}sudo tee /usr/local/bin/awf > /dev/null <<EOF`,
+    `${scriptIndent}#!/bin/bash`,
+    `${scriptIndent}exec "${'${NODE_BIN}'}" "${'${WORKSPACE_PATH}'}/dist/cli.js" "\\$@"`,
+    `${scriptIndent}EOF`,
+    `${scriptIndent}sudo chmod +x /usr/local/bin/awf`,
+  ].join('\n') + '\n';
+}
+
+for (const workflowPath of workflowPaths) {
+  const content = fs.readFileSync(workflowPath, 'utf-8');
+  const matches = content.match(installStepRegexGlobal);
+
+  if (!matches || matches.length === 0) {
+    console.log(`Skipping ${workflowPath}: no awf install step found.`);
+    continue;
+  }
+
+  if (matches.length !== 1) {
+    throw new Error(
+      `Expected exactly one awf install step in ${workflowPath}, found ${matches.length}. ` +
+        'Ensure the workflow has a single "Install awf binary" step in the agent job.'
+    );
+  }
+
+  const updated = content.replace(
+    installStepRegexGlobal,
+    (_match, indent: string) => buildLocalInstallSteps(indent)
+  );
+
+  fs.writeFileSync(workflowPath, updated);
+  console.log(`Updated ${workflowPath}`);
+}