diff --git a/.github/labeler.yml b/.github/labeler.yml
index bc54947..ed5a6e8 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -3,18 +3,27 @@
 
 # Label for CI/CD changes
 ci/cd:
-  - .github/workflows/*
+  - changed-files:
+      - any-glob-to-any-file: '.github/workflows/*'
+      - any-glob-to-any-file: 'justfile'
+      - any-glob-to-any-file: 'Dockerfile'
 
 # Label for documentation changes
 documentation:
-  - README.md
-  - docs/**/*.md # Updated path for all docs
-  - "*.md" # Root level markdown files
+  - changed-files:
+      - any-glob-to-any-file: 'README.md'
+      - any-glob-to-any-file: 'docs/**/*.md'
+      - any-glob-to-any-file: 'docs/**/*'
+      - any-glob-to-any-file: '*.md'
 
 # Label for source code changes
 source:
-  - main.ts
-  - "**/*.ts" # All TypeScript files
+  - changed-files:
+      - any-glob-to-any-file: 'src/**/*.ts'
+      - any-glob-to-any-file: 'src/**/*.js'
+      - any-glob-to-any-file: 'src/**/*.json'
+      - any-glob-to-any-file: 'src/**/*.md'
+      - any-glob-to-any-file: 'main.ts'
 
 # Label for configuration changes / patches
 patch:
@@ -30,3 +39,31 @@ patch:
   - .github/*.yml # Other root .github YAML configs
   - .gitignore
   - .gitattributes
+
+scripts:
+  - changed-files:
+      - any-glob-to-any-file: 'scripts/**/*'
+
+config:
+  - changed-files:
+      - any-glob-to-any-file: '.env'
+      - any-glob-to-any-file: '.env.example'
+      - any-glob-to-any-file: 'deno.json'
+      - any-glob-to-any-file: 'deno.lock'
+      - any-glob-to-any-file: 'biome.json'
+      - any-glob-to-any-file: '.nvmrc'
+      - any-glob-to-any-file: '.pre-commit-config.yaml'
+      - any-glob-to-any-file: '.shellcheckrc'
+      - any-glob-to-any-file: '.gitattributes'
+      - any-glob-to-any-file: '.gitignore'
+      - any-glob-to-any-file: '.vscode/**/*'
+
+meta:
+  - changed-files:
+      - any-glob-to-any-file: 'LICENSE'
+      - any-glob-to-any-file: 'SECURITY.md'
+      - any-glob-to-any-file: '.github/labeler.yml'
+      - any-glob-to-any-file: '.github/settings.yml'
+      - any-glob-to-any-file: '.github/ISSUE_TEMPLATE/*'
+      - any-glob-to-any-file: '.github/CODEOWNERS'
+      - any-glob-to-any-file: '.github/*.yml'
diff --git a/.github/settings.yml b/.github/settings.yml
index bf29d7c..abfb0f7 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -89,12 +89,37 @@ branches:
           # - "Format Check" # Often done locally or via pre-commit, but can be added
           # Add other required checks like build steps if applicable
 
+      require_signatures: true
+
       enforce_admins: false # Admins are not exempt from protection rules
       required_linear_history: true # Enforce linear history
       restrictions: # Restrict who can push to main (ADJUST AS NEEDED)
         users: [Excoriate]
         teams: [maintainers]
 
+  - name: master
+    protection:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+        dismiss_stale_reviews: true
+        require_code_owner_reviews: true
+        dismissal_restrictions: {}
+        required_conversation_resolution: true
+
+      required_status_checks:
+        strict: true
+        contexts:
+          - "Lint"
+          - "Test"
+
+      require_signatures: true
+
+      enforce_admins: false
+      required_linear_history: true
+      restrictions:
+        users: [Excoriate]
+        teams: [maintainers]
+
 # Removed Template-Specific Repository Metadata
 # repository_config:
 #   template_generation_date: 2024-01-15
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index a777125..da29db5 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -23,5 +23,5 @@ jobs:
         uses: ncipollo/release-action@v1
         with:
           tag: ${{ steps.tag_version.outputs.new_tag }}
-          name: Release ${{ steps.tag_version.outputs.new_tag }}
+          name: ${{ steps.tag_version.outputs.new_tag }}
           body: ${{ steps.tag_version.outputs.changelog }}
diff --git a/.github/workflows/labels-assigner.yml b/.github/workflows/labels-assigner.yml
index cac61f9..7a6abe4 100644
--- a/.github/workflows/labels-assigner.yml
+++ b/.github/workflows/labels-assigner.yml
@@ -1,7 +1,7 @@
 ---
-name: Assign labels on PR
+name: 🔖 Assign labels on PR
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 defaults:
   run:
@@ -13,9 +13,11 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v3
+      - uses: actions/labeler@v5
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: true
+          configuration-path: .github/labeler.yml
   size-label:
     runs-on: ubuntu-latest
     steps: