diff --git a/.github/workflows/app-build.yaml b/.github/workflows/app-build.yaml
index 62c866b7..39fcd90e 100644
--- a/.github/workflows/app-build.yaml
+++ b/.github/workflows/app-build.yaml
@@ -1,4 +1,4 @@
-name: App Build
+name: App / Build
 
 on:
   push:
@@ -6,9 +6,13 @@ on:
       - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    name: Build
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
@@ -16,18 +20,17 @@ jobs:
         uses: actions/setup-java@d854b6da19cdadd9a010605529e522c2393ebd38 # tag=v3
         with:
           distribution: temurin
-          java-version: 11
-          cache: gradle
+          java-version: 17
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@c295a4096e1d2c453eaf1f65c6f96686e26bd8be # tag=v2
       - name: Assemble debug APKs
-        run: ./gradlew --no-daemon --info assembleDebug
-      - name: Split APK release types
-        run: |
-          mkdir -p build/jellyfin-publish
-          mv app/build/outputs/apk/*/*/jellyfin-android-*-libre-debug.apk build/jellyfin-publish/
-          mv app/build/outputs/apk/*/*/jellyfin-android-*-proprietary-debug.apk build/jellyfin-publish/
-      - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
+        run: ./gradlew assembleDebug
+      - name: Create publish bundle
+        run: mkdir -p build/gh-app-publish/; find app/build/ -iname "*.apk" -exec mv "{}" build/gh-app-publish/ \;
+      - name: Upload artifacts
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3
         with:
           name: build-artifacts
           retention-days: 14
           if-no-files-found: error
-          path: build/jellyfin-publish
+          path: build/gh-app-publish/
diff --git a/.github/workflows/app-lint.yaml b/.github/workflows/app-lint.yaml
index 585a820c..c2743975 100644
--- a/.github/workflows/app-lint.yaml
+++ b/.github/workflows/app-lint.yaml
@@ -1,4 +1,4 @@
-name: App Lint
+name: App / Lint
 
 on:
   push:
@@ -7,9 +7,14 @@ on:
       - release-*
   pull_request:
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   lint:
-    runs-on: ubuntu-20.04
+    name: Lint
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
@@ -17,10 +22,11 @@ jobs:
         uses: actions/setup-java@d854b6da19cdadd9a010605529e522c2393ebd38 # tag=v3
         with:
           distribution: temurin
-          java-version: 11
-          cache: gradle
+          java-version: 17
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@c295a4096e1d2c453eaf1f65c6f96686e26bd8be # tag=v2
       - name: Run detekt and lint tasks
-        run: ./gradlew --build-cache --no-daemon --info detekt lint
+        run: ./gradlew detekt lint
       - name: Upload SARIF files
         uses: github/codeql-action/upload-sarif@86f3159a697a097a813ad9bfa0002412d97690a4 # tag=v2
         if: ${{ always() }}
diff --git a/.github/workflows/app-publish.yaml b/.github/workflows/app-publish.yaml
index 6f6bac21..b5f3e064 100644
--- a/.github/workflows/app-publish.yaml
+++ b/.github/workflows/app-publish.yaml
@@ -1,4 +1,4 @@
-name: App Publish
+name: App / Publish
 
 on:
   push:
@@ -6,9 +6,10 @@ on:
       - v*
 
 jobs:
-  build:
-    runs-on: ubuntu-20.04
-    if: ${{ github.repository == 'jellyfin/jellyfin-android' }}
+  publish:
+    name: Publish
+    runs-on: ubuntu-22.04
+    if: ${{ contains(github.repository_owner, 'jellyfin') }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
@@ -16,11 +17,13 @@ jobs:
         uses: actions/setup-java@d854b6da19cdadd9a010605529e522c2393ebd38 # tag=v3
         with:
           distribution: temurin
-          java-version: 11
+          java-version: 17
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@c295a4096e1d2c453eaf1f65c6f96686e26bd8be # tag=v2
       - name: Set JELLYFIN_VERSION
         run: echo "JELLYFIN_VERSION=$(echo ${GITHUB_REF#refs/tags/v} | tr / -)" >> $GITHUB_ENV
-      - name: Assemble release APKs and bundle
-        run: ./gradlew --no-daemon --info assemble bundleProprietaryRelease versionTxt
+      - name: Assemble release files
+        run: ./gradlew assemble bundleProprietaryRelease versionTxt
       - name: Sign libre APK
         id: libreSign
         uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # tag=v1
@@ -48,7 +51,7 @@ jobs:
           keyStorePassword: ${{ secrets.KEYSTORE_PASSWORD }}
           alias: ${{ secrets.KEY_ALIAS }}
           keyPassword: ${{ secrets.KEY_PASSWORD }}
-      - name: Collect APK and bundle artifacts in release directory
+      - name: Prepare release archive
         run: |
           mkdir -p build/jellyfin-publish
           mv app/build/outputs/apk/*/*/jellyfin-android-*-libre-debug.apk build/jellyfin-publish/
@@ -59,13 +62,13 @@ jobs:
           mv ${{ steps.proprietarySign.outputs.signedReleaseFile }} build/jellyfin-publish/jellyfin-android-v${{ env.JELLYFIN_VERSION }}-proprietary-release.apk
           mv ${{ steps.proprietaryBundleSign.outputs.signedReleaseFile }} build/jellyfin-publish/jellyfin-android-v${{ env.JELLYFIN_VERSION }}-proprietary-release.aab
           mv app/build/version.txt build/jellyfin-publish/
-      - name: Upload release artifacts
+      - name: Upload release archive to GitHub release
         uses: alexellis/upload-assets@5586bc227f8525a5e3525e6edf64da5350bfb5b1 # tag=0.3.0
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
         with:
           asset_paths: '["build/jellyfin-publish/*"]'
-      - name: Upload to repo.jellyfin.org
+      - name: Upload release archive to repo.jellyfin.org
         uses: burnett01/rsync-deployments@0dc935cdecc5f5e571865e60d2a6cdc673704823 # tag=5.2
         with:
           switches: -vrptz
diff --git a/.github/workflows/app-test.yaml b/.github/workflows/app-test.yaml
index f6e07fdd..e1195154 100644
--- a/.github/workflows/app-test.yaml
+++ b/.github/workflows/app-test.yaml
@@ -1,4 +1,4 @@
-name: App Test
+name: App / Test
 
 on:
   push:
@@ -7,9 +7,13 @@ on:
       - release-*
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-20.04
+    name: Test
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
@@ -17,7 +21,8 @@ jobs:
         uses: actions/setup-java@d854b6da19cdadd9a010605529e522c2393ebd38 # tag=v3
         with:
           distribution: temurin
-          java-version: 11
-          cache: gradle
-      - name: Run test and assemble tasks
-        run: ./gradlew --no-daemon --build-cache test
+          java-version: 17
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@c295a4096e1d2c453eaf1f65c6f96686e26bd8be # tag=v2
+      - name: Run test task
+        run: ./gradlew test
diff --git a/.github/workflows/gradlew-update.yaml b/.github/workflows/gradlew-update.yaml
index 8b105065..0e67bea7 100644
--- a/.github/workflows/gradlew-update.yaml
+++ b/.github/workflows/gradlew-update.yaml
@@ -1,4 +1,4 @@
-name: Gradle update
+name: Gradle / Update wrapper
 
 on:
   schedule:
@@ -6,8 +6,9 @@ on:
 
 jobs:
   update:
-    runs-on: ubuntu-20.04
-    if: github.repository == 'jellyfin/jellyfin-android'
+    name: Update
+    runs-on: ubuntu-22.04
+    if: ${{ contains(github.repository_owner, 'jellyfin') }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
diff --git a/.github/workflows/gradlew-validate.yaml b/.github/workflows/gradlew-validate.yaml
index d0269432..f21efd26 100644
--- a/.github/workflows/gradlew-validate.yaml
+++ b/.github/workflows/gradlew-validate.yaml
@@ -1,4 +1,4 @@
-name: Gradle validate
+name: Gradle / Validate wrapper
 
 on:
   push:
@@ -8,9 +8,13 @@ on:
     paths:
       - '**/gradlе-wrapper.jar'
 
+permissions:
+  contents: read
+
 jobs:
   validate:
-    runs-on: ubuntu-20.04
+    name: Validate
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
diff --git a/.github/workflows/merge-conflict-labeler.yaml b/.github/workflows/repo-merge-conflict.yaml
similarity index 68%
rename from .github/workflows/merge-conflict-labeler.yaml
rename to .github/workflows/repo-merge-conflict.yaml
index 27ac9f0b..8c625f8f 100644
--- a/.github/workflows/merge-conflict-labeler.yaml
+++ b/.github/workflows/repo-merge-conflict.yaml
@@ -1,4 +1,4 @@
-name: Merge conflict labeler
+name: Repo / Label merge conflict
 
 on:
   push:
@@ -8,8 +8,9 @@ on:
 
 jobs:
   triage:
-    runs-on: ubuntu-20.04
-    if: github.repository == 'jellyfin/jellyfin-android'
+    name: Triage
+    runs-on: ubuntu-22.04
+    if: ${{ contains(github.repository_owner, 'jellyfin') }}
     steps:
       - uses: eps1lon/actions-label-merge-conflict@b8bf8341285ec9a4567d4318ba474fee998a6919 # tag=v2.0.1
         with:
diff --git a/.github/workflows/repo-stale.yaml b/.github/workflows/repo-stale.yaml
index c487450f..3ed8ade9 100644
--- a/.github/workflows/repo-stale.yaml
+++ b/.github/workflows/repo-stale.yaml
@@ -1,4 +1,4 @@
-name: Issue stale check
+name: Repo / Reply stale issue
 
 on:
   schedule:
@@ -10,9 +10,10 @@ permissions:
   pull-requests: write
 
 jobs:
-  stale:
-    runs-on: ubuntu-20.04
-    if: github.repository == 'jellyfin/jellyfin-android'
+  triage:
+    name: Triage
+    runs-on: ubuntu-22.04
+    if: ${{ contains(github.repository_owner, 'jellyfin') }}
     steps:
       - uses: actions/stale@3de2653986ebd134983c79fe2be5d45cc3d9f4e1 # tag=v6
         with:
@@ -25,7 +26,7 @@ jobs:
           stale-issue-label: stale
           stale-issue-message: |-
             This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
-            
+
             If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or master branch, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
-            
+
             This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on [Matrix or Social Media](https://docs.jellyfin.org/general/getting-help.html).