diff --git a/.github/workflows/_detect-changes.yml b/.github/workflows/_detect-changes.yml
index 55712e6..7d34859 100644
--- a/.github/workflows/_detect-changes.yml
+++ b/.github/workflows/_detect-changes.yml
@@ -70,6 +70,17 @@ jobs:
         run: |
           set -euo pipefail
 
+          # workflow_dispatch has no before SHA. Callers deliberately pass an
+          # empty base for that event, which means "run every category" rather
+          # than attempting an invalid/empty git diff.
+          if [ -z "$BASE_SHA" ]; then
+            echo "No base SHA supplied; treating manual dispatch as all paths changed."
+            echo "db_changed=true" >> "$GITHUB_OUTPUT"
+            echo "app_changed=true" >> "$GITHUB_OUTPUT"
+            echo "config_changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # Diff includes added/modified/deleted files.
           mapfile -t CHANGED_FILES < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
 
diff --git a/.github/workflows/_pg-migration-test.yml b/.github/workflows/_pg-migration-test.yml
index 0f1bef8..362642f 100644
--- a/.github/workflows/_pg-migration-test.yml
+++ b/.github/workflows/_pg-migration-test.yml
@@ -38,18 +38,32 @@ jobs:
           POSTGRES_PASSWORD: test
           POSTGRES_DB: test
         ports:
-          - 5432:5432
+          # Let Actions allocate an available host port. Self-hosted runners
+          # commonly already have (or reserve) 5432, so a fixed mapping is
+          # not a reliable way for the job process to reach this service.
+          - 5432/tcp
         options: >-
-          --health-cmd pg_isready
+          --health-cmd "pg_isready -U postgres -d test"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
     env:
       ATLAS_VERSION: v1.3.0
-      DATABASE_URL: postgres://postgres:test@localhost:5432/test?sslmode=disable
     steps:
       - uses: actions/checkout@v6
 
+      # The job.services context is only available inside steps, not in the
+      # job-level env block. On the self-hosted fleet, this job executes in a
+      # runner container while service ports are published on the Docker host;
+      # the bridge gateway reaches that host (127.0.0.1 would be the runner).
+      - name: Configure ephemeral Postgres URL
+        env:
+          POSTGRES_PORT: ${{ job.services.postgres.ports[5432] }}
+        run: |
+          set -euo pipefail
+          DOCKER_HOST_GATEWAY=$(docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}')
+          echo "DATABASE_URL=postgres://postgres:test@${DOCKER_HOST_GATEWAY}:${POSTGRES_PORT}/test?sslmode=disable" >> "$GITHUB_ENV"
+
       - name: Install Atlas CLI
         run: |
           curl -sSf https://atlasgo.sh | sh -s -- --community --yes --version "$ATLAS_VERSION"
diff --git a/.github/workflows/obsidian-plugin-ci.yml b/.github/workflows/obsidian-plugin-ci.yml
index 221b0b8..081c162 100644
--- a/.github/workflows/obsidian-plugin-ci.yml
+++ b/.github/workflows/obsidian-plugin-ci.yml
@@ -14,6 +14,15 @@ on:
       RELEASE_TOKEN:
         required: false
 
+# No consumer of this shared template previously had any concurrency dedup,
+# so rapid pushes to the same branch queued/ran independently with no
+# cancellation. Scoped per calling repo (multiple repos share this template)
+# and per event type so push and PR runs don't collide.
+concurrency:
+  group: >-
+    ${{ github.repository }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   filter:
     name: Check for Code Changes
diff --git a/.github/workflows/self-ci.yml b/.github/workflows/self-ci.yml
new file mode 100644
index 0000000..ab565fa
--- /dev/null
+++ b/.github/workflows/self-ci.yml
@@ -0,0 +1,30 @@
+name: Self CI
+
+# ---------------------------------------------------------------------------
+# Validates this repo's own reusable workflows (.github/workflows/*.yml)
+# before they reach consumers: catches YAML/syntax/expression errors via
+# actionlint. Not a full test harness — just a fast lint pass.
+# ---------------------------------------------------------------------------
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+concurrency:
+  group: >-
+    self-ci-${{ github.repository }}-${{ github.event_name }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: reviewdog/action-actionlint@v1
+        with:
+          fail_level: error