diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1cddbaea1..fbbfa4bc8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -106,7 +106,7 @@ updates:
           - com.google.firebase:firebase-analytics-ktx
 
   - package-ecosystem: swift
-    directory: swift/apple/FirezoneKit/
+    directory: swift/apple/Firezone.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/
     schedule:
       interval: monthly
   - package-ecosystem: npm
@@ -114,7 +114,7 @@ updates:
     schedule:
       interval: monthly
   - package-ecosystem: npm
-    directory: rust/windows-client/
+    directory: rust/gui-client/
     schedule:
       interval: monthly
   - package-ecosystem: npm
diff --git a/.github/requirements.txt b/.github/requirements.txt
index 86d5df925..6aaf1f07a 100644
--- a/.github/requirements.txt
+++ b/.github/requirements.txt
@@ -1,2 +1,2 @@
-pre-commit==3.6.0
+pre-commit==3.6.2
 codespell==2.2.6
diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index af61a9ca5..e58e1ce94 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -2,6 +2,8 @@ name: "CodeQL"
 on:
   workflow_call:
   push:
+    branches:
+      - main
 
 jobs:
   analyze:
diff --git a/.github/workflows/_elixir.yml b/.github/workflows/_elixir.yml
index 01ff5a841..acff93f8d 100644
--- a/.github/workflows/_elixir.yml
+++ b/.github/workflows/_elixir.yml
@@ -53,7 +53,7 @@ jobs:
         run: mix deps.compile --skip-umbrella-children
       - uses: actions/cache/save@v4
         name: Save Elixir Deps Cache
-        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: elixir-deps-${{ env.MIX_ENV }}
         with:
@@ -119,7 +119,7 @@ jobs:
         run: mix deps.compile --skip-umbrella-children
       - uses: actions/cache/save@v4
         name: Save Elixir Deps Cache
-        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: elixir-deps-${{ env.MIX_ENV }}
         with:
@@ -142,7 +142,7 @@ jobs:
         if: ${{ steps.plt_cache.outputs.cache-hit != 'true' }}
         run: mix dialyzer --plt
       - uses: actions/cache/save@v4
-        if: ${{ steps.plt_cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' }}
+        if: ${{ github.ref_name == 'main' }}
         name: Save PLT cache
         with:
           key: ubuntu-22.04-${{ runner.arch }}-${{ steps.setup-beam.outputs.elixir-version }}-${{ hashFiles('elixir/mix.lock') }}
@@ -186,7 +186,7 @@ jobs:
         run: mix deps.compile --skip-umbrella-children
       - uses: actions/cache/save@v4
         name: Save Elixir Deps Cache
-        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: elixir-deps-${{ env.MIX_ENV }}
         with:
@@ -265,7 +265,7 @@ jobs:
         run: mix deps.compile --skip-umbrella-children
       - uses: actions/cache/save@v4
         name: Save Elixir Deps Cache
-        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: elixir-deps-${{ env.MIX_ENV }}
         with:
@@ -414,7 +414,7 @@ jobs:
         run: mix deps.compile --skip-umbrella-children
       - uses: actions/cache/save@v4
         name: Save Elixir Deps Cache
-        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: elixir-deps-${{ env.MIX_ENV }}
         with:
@@ -443,7 +443,7 @@ jobs:
           mix assets.setup
       - uses: actions/cache/save@v4
         name: Save pnpm Deps Cache
-        if: ${{ steps.pnpm-web-deps-cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: pnpm-deps-web
         with:
@@ -470,7 +470,7 @@ jobs:
           mix assets.build
       - uses: actions/cache/save@v4
         name: Save Web Assets Cache
-        if: ${{ steps.pnpm-web-build-cache.outputs.cache-hit != 'true' }}
+        if: ${{ github.ref_name == 'main' }}
         env:
           cache-name: pnpm-build-web
         with: