diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f414bb8..f30f726 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,22 @@
 name: ci
 on:
   pull_request:
+    types: [opened, synchronize, reopened, edited]
   push:
     branches: [dev, main]
+permissions:
+  contents: read
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: term wall
+        uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10
+        env:
+          TERM_WALL: ${{ vars.TERM_WALL }}
       - name: JSON validity
         run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty
       - name: YAML validity
diff --git a/.mcp.json b/.mcp.json
index e16128b..7a030cd 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,16 @@
   "mcpServers": {
     "serena": {
       "command": "uvx",
-      "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."]
+      "args": [
+        "--from",
+        "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84",
+        "serena",
+        "start-mcp-server",
+        "--context",
+        "claude-code",
+        "--project",
+        "."
+      ]
     }
   }
 }