diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e12df80..50e80d3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,16 +12,21 @@ on:
 jobs:
   lint:
     name: Lint
-    uses: canonical/data-platform-workflows/.github/workflows/lint_workflows.yaml@v46.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/lint_workflows.yaml@v50
+    permissions:
+      contents: read
 
   build:
     name: Build rock
-    uses: canonical/data-platform-workflows/.github/workflows/build_rock.yaml@v46.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/build_rock.yaml@v50
+    permissions:
+      contents: read
 
   test:
     name: Test rock | ${{ matrix.base.version }} ${{ matrix.platform.arch }}
-    timeout-minutes: 10
+    permissions: {}
     runs-on: "ubuntu-${{ matrix.base.version }}${{ matrix.platform.gh_suffix }}"
+    timeout-minutes: 10
     strategy:
       fail-fast: false
       matrix:
@@ -35,23 +40,18 @@ jobs:
       - build
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Download rock package(s)
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           pattern: ${{ needs.build.outputs.artifact-prefix }}-*-${{ matrix.platform.arch }}
           merge-multiple: true
+      - name: Install dependencies
+        run: |
+          go install github.com/canonical/spread/cmd/spread@latest
       - name: Run tests
         run: |
-          # lxd is necessary for spread
-          sudo snap install lxd
-          sudo adduser "$USER" lxd
-          # `newgrp` does not work in GitHub Actions; use `sudo --user` instead
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxd waitready
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- lxd init --auto
-          # Workaround for Docker & LXD on same machine
-          sudo iptables -F FORWARD
-          sudo iptables -P FORWARD ACCEPT
-
-          sudo snap install rockcraft --classic --edge
-          sudo --user "$USER" --preserve-env --preserve-env=PATH -- env -- rockcraft test
+          ROCK_FILENAME=$(ls -- *.rock)
+          CRAFT_ARTIFACT="$(pwd)/$ROCK_FILENAME" "$HOME/go/bin/spread" -v github-ci:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 24f42d4..2e16f65 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,17 +15,18 @@ on:
 jobs:
   build:
     name: Build rock
-    uses: canonical/data-platform-workflows/.github/workflows/build_rock.yaml@v46.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/build_rock.yaml@v50
+    permissions:
+      contents: read
 
   release:
     name: Release rock
     needs:
       - build
-    uses: canonical/data-platform-workflows/.github/workflows/release_rock_edge.yaml@v46.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/release_rock_edge.yaml@v50
     with:
       artifact-prefix: ${{ needs.build.outputs.artifact-prefix }}
     permissions:
-      actions: read    # Needed for GitHub API call to get workflow version
       packages: write  # Needed to publish to GitHub Container Registry
       contents: write  # Needed to create git tags
 
@@ -35,6 +36,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions: {}
     steps:
       - name: Install Syft
         run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
@@ -66,9 +68,12 @@ jobs:
     needs:
       - release
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Golang setup
         uses: actions/setup-go@v5
         with:
diff --git a/.github/zizmor.yaml b/.github/zizmor.yaml
new file mode 100644
index 0000000..94517a7
--- /dev/null
+++ b/.github/zizmor.yaml
@@ -0,0 +1,27 @@
+rules:
+  # Allowlist trusted actions
+  forbidden-uses:
+    config:
+      # Actions in this list have remote code execution in our workflows. Even if the workflow has
+      # limited permissions, those can be escaped. See https://github.com/AdnaneKhan/Cacheract and
+      # "But Wait, There’s More" section of
+      # https://www.praetorian.com/blog/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/
+      # In general, this list should be limited to organizations that we trust to have a baseline
+      # level of operational security. Avoid adding actions that could be replaced with a few lines
+      # of bash.
+      allow:  # Get approval from your manager before adding actions to this list.
+        - canonical/*
+        - actions/*
+  # Pinning actions to a commit SHA has a security tradeoff—pinned actions cannot be later
+  # compromised, but they also cannot be security patched.
+  # Above (in `forbidden-uses`), we restrict actions usage to organizations that we trust to have
+  # a baseline level of operational security.
+  # Our actions usage involves several long-term support branches and reusable workflows (which
+  # themselves use actions). For our threat model, we believe it is safer to limit actions usage to
+  # organizations we trust and immediately receive security patching across our many branches than
+  # it is to pin actions to a commit SHA.
+  unpinned-uses:
+    config:
+      policies:
+        canonical/*: ref-pin
+        actions/*: ref-pin
diff --git a/rockcraft.yaml b/rockcraft.yaml
index 7cfe7d8..1a59386 100644
--- a/rockcraft.yaml
+++ b/rockcraft.yaml
@@ -1,6 +1,6 @@
 name: mysql
 base: ubuntu@24.04
-version: '8.0.45'
+version: '8.0.46'
 summary: MySQL rock OCI
 description: |
     MySQL built from the official MySQL package from the MySQL repository.
diff --git a/spread.yaml b/spread.yaml
index 87054c1..88d192a 100644
--- a/spread.yaml
+++ b/spread.yaml
@@ -1,30 +1,39 @@
 project: mysql-rock
 
+path: /home/ubuntu/mysql-rock
+
+environment:
+  CRAFT_ARTIFACT: $(HOST:printenv CRAFT_ARTIFACT)
+
 backends:
-  craft:
-    type: craft
+  lxd-vm:
+    type: adhoc
+    allocate: ADDRESS $(./spread/.extension allocate lxd-vm)
+    discard: ./spread/.extension discard lxd-vm
     systems:
       - ubuntu-24.04
 
+  github-ci:
+    type: adhoc
+    manual: true
+    allocate: ADDRESS $(./spread/.extension allocate ci)
+    discard: ./spread/.extension discard ci
+    environment:
+      CI: '$(HOST: echo $CI)'
+    systems:
+      - ubuntu-24.04:
+          username: runner
+
 suites:
   spread/tests/:
     summary: General integration tests
 
     prepare: |
-      # For 'rockcraft.skopeo'
-      snap install rockcraft --classic --edge
-      snap install docker
-
-      # Wait for docker daemon to come online
-      apt install -y retry
-      retry --times=10 --delay 2 -- docker run hello-world
-
-      # Load the rock into docker
-      rockcraft.skopeo --insecure-policy copy "oci-archive:$CRAFT_ARTIFACT" docker-daemon:mysql:spreadtest
-
-      # Install mysql client
       apt update
-      apt install -y mysql-client
+      apt install -y retry mysql-client skopeo
+      snap install docker
+      retry --times=10 --delay=2 -- docker run hello-world
+      skopeo --insecure-policy copy "oci-archive:${SPREAD_PATH}/$(basename "${CRAFT_ARTIFACT}")" docker-daemon:mysql:spreadtest
     prepare-each: |
       docker run -d --rm -e MYSQL_ROOT_PASSWORD=myS3cr3tp@ss -p 3432:3306 --name "${SPREAD_TASK//\//_}" mysql:spreadtest
       # wait for initialization
@@ -32,7 +41,7 @@ suites:
     restore-each: |
       docker kill "${SPREAD_TASK//\//_}" || true
     restore: |
-      docker image rm --force mysql:spreadtest
+      docker image rm --force mysql:spreadtest || true
 
 exclude:
   - .git
diff --git a/spread/.extension b/spread/.extension
index 031b578..8a63f35 100755
--- a/spread/.extension
+++ b/spread/.extension
@@ -95,8 +95,21 @@ allocate_lxdvm() {
 }
 
 discard_lxdvm() {
-    instance_name="$(lxc ls -f csv | grep ",$SPREAD_SYSTEM_ADDRESS " | cut -f1 -d",")"
-    lxc delete -f "$instance_name"
+    instance_name="$(lxc ls -f json |
+  jq -r --arg addr "$SPREAD_SYSTEM_ADDRESS" '
+    .[] |
+    select(.type == "virtual-machine") |
+    .name as $name |
+    .state.network |
+    to_entries[] |
+    select(.key != "docker0" and .key != "lo") |
+    .value.addresses[] |
+    select(.family == "inet" and .scope == "global" and .address == $addr) |
+    $name
+  ' | head -1)"
+    if [ -n "$instance_name" ]; then
+        lxc delete -f "$instance_name" || true
+    fi
 }
 
 allocate_ci() {
@@ -104,14 +117,15 @@ allocate_ci() {
         echo "This backend is intended to be used only in CI systems."
         exit 1
     fi
-    sudo sed -i 's/^\s*#\?\s*\(PermitRootLogin\|PasswordAuthentication\)\>.*/\1 yes/' /etc/ssh/sshd_config
-    if [ -d /etc/ssh/sshd_config.d ]; then echo -e 'PermitRootLogin yes\nPasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-spread.conf; fi
-    sudo systemctl daemon-reload
-    sudo systemctl restart ssh
+    sudo tee /etc/ssh/sshd_config.d/10-spread-github-ci.conf << 'EOF'
+    PasswordAuthentication yes
+    PermitEmptyPasswords yes
+EOF
 
-    echo "root:${SPREAD_PASSWORD}" | sudo chpasswd || true
+    sudo passwd --delete "$USER"
+
+    sudo systemctl reload ssh || sudo systemctl restart ssh
 
-    # Print the instance address to stdout
     echo localhost >&3
 }
 
diff --git a/spread/tests/smoke/task.yaml b/spread/tests/smoke/task.yaml
index 197f627..04a8eac 100644
--- a/spread/tests/smoke/task.yaml
+++ b/spread/tests/smoke/task.yaml
@@ -21,4 +21,3 @@ execute: |
 
   docker exec -t "${SPREAD_TASK//\//_}" pebble logs
   docker exec -t "${SPREAD_TASK//\//_}" pebble services
-
diff --git a/spread/tests/versions/task.yaml b/spread/tests/versions/task.yaml
index 59f70ed..459fd3b 100644
--- a/spread/tests/versions/task.yaml
+++ b/spread/tests/versions/task.yaml
@@ -9,4 +9,3 @@ execute: |
         --port=3432 \
         --user=root \
         --execute="select @@version;" | grep -q -e "^${ROCK_VERSION}"
-