diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..26ac869
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,10 @@
+# https://EditorConfig.org
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+charset = utf-8
+indent_style = space
+indent_size = 2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8b45fb..a382e9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,8 @@ name: Release
 on:
   push: { tags: 'v[0-9]+.[0-9]+.[0-9]+*' }
 
+permissions: read-all
+
 jobs:
   release:
     permissions: { contents: write }
diff --git a/.github/workflows/sync-default-branch.yml b/.github/workflows/sync-default-branch.yml
index 1c12fdd..a4c8333 100644
--- a/.github/workflows/sync-default-branch.yml
+++ b/.github/workflows/sync-default-branch.yml
@@ -3,6 +3,8 @@ on:
   push: { branches: main }
   workflow_dispatch:
 
+permissions: read-all
+
 # One-time commands for users to switch-over:
 #
 # ```console
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e9b8aba..a49c83f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,9 +1,12 @@
 name: Test
-on: [push, pull_request]
+on: [push, pull_request, workflow_dispatch]
+
+permissions: read-all
 
 jobs:
   test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm cit
+    uses: nodenv/.github/.github/workflows/test.yml@v4
+    permissions:
+      contents: read
+      packages: read
+      statuses: write # to report status checks
diff --git a/README.md b/README.md
index bad0559..7bbacae 100644
--- a/README.md
+++ b/README.md
@@ -30,18 +30,18 @@ If installed outside of `NODENV_ROOT`, you must ensure its `share/node-build` di
 
 To install, clone this repository into your `$(nodenv root)/plugins` directory.
 
-    $ git clone /~https://github.com/nodenv/node-build-update-defs.git "$(nodenv root)"/plugins/node-build-update-defs
+    git clone /~https://github.com/nodenv/node-build-update-defs.git "$(nodenv root)"/plugins/node-build-update-defs
 
 ### Installing with Homebrew
 
-    $ brew install nodenv/nodenv/node-build-update-defs
+    brew install nodenv/nodenv/node-build-update-defs
 
 *__Note:__
 Requires manually adding `$(brew --prefix node-build-update-defs)/share/node-build` directory to `NODE_BUILD_DEFINITIONS`*
 
 ### Installation with npm
 
-    $ npm install --global @nodenv/node-build-update-defs
+    npm install --global @nodenv/node-build-update-defs
 
 *__Note:__
 Requires manually adding `$(npm -g prefix)/lib/node_modules/@nodenv/node-build-update-defs/share/node-build` directory to `NODE_BUILD_DEFINITIONS`*
@@ -54,12 +54,12 @@ Unlike virtually every other nodenv plugin, node-build-update-defs actually depe
 (The scraper runs on node.)
 A somewhat recent version of node is required – it is recommended to configure a node-version within the plugin directory itself (substitute your chosen version):
 
-    $ cd "$(nodenv root)"/plugins/node-build-update-defs
-    $ nodenv local 6.0
+    cd "$(nodenv root)"/plugins/node-build-update-defs
+    nodenv local 6.0
 
 ## Usage
 
-    $ nodenv update-version-defs
+    nodenv update-version-defs
 
 By default, this will create build definitions in the plugin's `share/node-build/` directory.
 This directory can be overridden with `--destination`.
@@ -84,7 +84,7 @@ In normal operation, build definitions will gradually build up in this plugin's
 Eventually, as the scraped definitions are added to node-build itself, these user-scraped definitions will become duplicates when their node-build installation is updated.
 In order to ensure one is frequently running on the "proper" build definitions from node-build, any duplicates in the plugin directory ought to be removed.
 
-    $ nodenv prune-version-defs
+    nodenv prune-version-defs
 
 This subcommand removes (or lists with `--dry-run`) any duplicate build definitions.
 Like `update-version-defs`, `--destination <dir>` overrides the default value of `<plugin-root>/share/node-build` as the directory from which duplicates are removed.
diff --git a/bin/nodenv-prune-version-defs b/bin/nodenv-prune-version-defs
index 8cd169e..9a286e8 100755
--- a/bin/nodenv-prune-version-defs
+++ b/bin/nodenv-prune-version-defs
@@ -54,29 +54,36 @@ shopt -u nullglob
 # Provide nodenv completions
 while [ $# -gt 0 ]; do
   case "$1" in
-    --complete )
-      echo --destination
-      echo --dry-run
-      echo --force
-      echo --help
-      echo --verbose
-      exit ;;
-    -d | --destination )
-      shift
-      # overwrite the defs write target
-      NODE_BUILD_DEFINITIONS="$(abs_dirname "${1%/}/"):${NODE_BUILD_DEFINITIONS}" ;;
-    -f | --force )
-      FORCE=true ;;
-    -h | --help )
-      exec nodenv-help update-version-defs ;;
-    -n | --dry-run )
-      DRY_RUN=true
-      VERBOSE=true ;;
-    -v | --verbose )
-      VERBOSE=true ;;
-    * )
-      nodenv-help --usage update-version-defs >&2
-      exit 1;;
+  --complete)
+    echo --destination
+    echo --dry-run
+    echo --force
+    echo --help
+    echo --verbose
+    exit
+    ;;
+  -d | --destination)
+    shift
+    # overwrite the defs write target
+    NODE_BUILD_DEFINITIONS="$(abs_dirname "${1%/}/"):${NODE_BUILD_DEFINITIONS}"
+    ;;
+  -f | --force)
+    FORCE=true
+    ;;
+  -h | --help)
+    exec nodenv-help update-version-defs
+    ;;
+  -n | --dry-run)
+    DRY_RUN=true
+    VERBOSE=true
+    ;;
+  -v | --verbose)
+    VERBOSE=true
+    ;;
+  *)
+    nodenv-help --usage update-version-defs >&2
+    exit 1
+    ;;
   esac
   shift
 done
diff --git a/bin/nodenv-update-version-defs b/bin/nodenv-update-version-defs
index 7ca1dfc..9f4dd9c 100755
--- a/bin/nodenv-update-version-defs
+++ b/bin/nodenv-update-version-defs
@@ -75,37 +75,44 @@ unset PATTERN
 # Provide nodenv completions
 while [ $# -gt 0 ]; do
   case "$1" in
-    --complete )
-      echo --destination
-      echo --dry-run
-      echo --force
-      echo --regexp
-      echo --nodejs
-      echo --nodejs-pre
-      echo --nodejs-nightly
-      echo --chakracore
-      echo --chakracore-pre
-      echo --chakracore-nightly
-      echo --graal
-      exit ;;
-    -d | --destination )
-      shift
-      # overwrite the defs write target
-      NODE_BUILD_DEFINITIONS="$(abs_dirname "${1%/}/"):${NODE_BUILD_DEFINITIONS}" ;;
-    -n | --dry-run)
-      DRY_RUN=true ;;
-    -f | --force)
-      FORCE=true ;;
-    -e | --regexp)
-      PATTERN=$2
-      shift ;;
-    --nodejs | --nodejs-pre | --nodejs-nightly | \
+  --complete)
+    echo --destination
+    echo --dry-run
+    echo --force
+    echo --regexp
+    echo --nodejs
+    echo --nodejs-pre
+    echo --nodejs-nightly
+    echo --chakracore
+    echo --chakracore-pre
+    echo --chakracore-nightly
+    echo --graal
+    exit
+    ;;
+  -d | --destination)
+    shift
+    # overwrite the defs write target
+    NODE_BUILD_DEFINITIONS="$(abs_dirname "${1%/}/"):${NODE_BUILD_DEFINITIONS}"
+    ;;
+  -n | --dry-run)
+    DRY_RUN=true
+    ;;
+  -f | --force)
+    FORCE=true
+    ;;
+  -e | --regexp)
+    PATTERN=$2
+    shift
+    ;;
+  --nodejs | --nodejs-pre | --nodejs-nightly | \
     --chakracore | --chakracore-pre | --chakracore-nightly | \
-    --graal )
-      SCRAPERS+=("${1#--}") ;;
-    * )
-      nodenv-help --usage update-version-defs >&2
-      exit 1;;
+    --graal)
+    SCRAPERS+=("${1#--}")
+    ;;
+  *)
+    nodenv-help --usage update-version-defs >&2
+    exit 1
+    ;;
   esac
   shift
 done
diff --git a/package-lock.json b/package-lock.json
index c069d05..dad21c8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,10 @@
       "version": "2.11.0",
       "hasInstallScript": true,
       "license": "MIT",
+      "bin": {
+        "nodenv-prune-version-defs": "bin/nodenv-prune-version-defs",
+        "nodenv-update-version-defs": "bin/nodenv-update-version-defs"
+      },
       "devDependencies": {
         "prettier-standard": "^16.4.1",
         "standard": "^17.1.0"
diff --git a/script/commit-definitions b/script/commit-definitions
index e6d2763..c8e17ed 100755
--- a/script/commit-definitions
+++ b/script/commit-definitions
@@ -15,9 +15,9 @@ IFS=$'\n\t'
 cd "$(git rev-parse --show-toplevel)" || exit
 
 git ls-files --others --exclude-standard -- share/node-build |
-while read -r node_def; do
-  node_name=${node_def##*/}
-  git add -- "$node_def"
-  git commit --quiet --message "$node_name" --message "Created with \`npm run submit-definitions\`." --only -- "$node_def"
-  echo "$node_name"
-done
+  while read -r node_def; do
+    node_name=${node_def##*/}
+    git add -- "$node_def"
+    git commit --quiet --message "$node_name" --message "Created with \`npm run submit-definitions\`." --only -- "$node_def"
+    echo "$node_name"
+  done
diff --git a/script/lts-lint-definitions b/script/lts-lint-definitions
index 93d409a..15acdb7 100755
--- a/script/lts-lint-definitions
+++ b/script/lts-lint-definitions
@@ -22,8 +22,8 @@ TODAY=$(date -u +'%F')
 
 for arg in "$@"; do
   case "$arg" in
-    --fix) FIX=1;;
-    *) DIR=$arg;;
+  --fix) FIX=1 ;;
+  *) DIR=$arg ;;
   esac
 done
 
@@ -87,7 +87,7 @@ prepend_message() {
   local file=$2
 
   sed -e "1 i\\
-$msg" "$file" 1<> "$file"
+$msg" "$file" 1<>"$file"
 }
 
 assert_message() {
@@ -116,8 +116,10 @@ assert_warnings() {
 
     echo "v$version maint: $maint_date eol: $eol_date" >&2
     {
-      if past "$eol_date"; then assert_message eol "$version"
-      elif past "$maint_date"; then assert_message lts "$version"
+      if past "$eol_date"; then
+        assert_message eol "$version"
+      elif past "$maint_date"; then
+        assert_message lts "$version"
       fi
     } || status=$?
   done
diff --git a/script/verify-definitions b/script/verify-definitions
index 1f85ab4..8b79cc8 100755
--- a/script/verify-definitions
+++ b/script/verify-definitions
@@ -8,7 +8,7 @@ set -eufo pipefail
 IFS=$'\n\t'
 
 help_text() {
-  sed -ne '/^#/!q;s/.\{1,2\}//;1d;p' < "$0"
+  sed -ne '/^#/!q;s/.\{1,2\}//;1d;p' <"$0"
 }
 
 compute_sha2() {
@@ -27,7 +27,7 @@ download_and_verify() {
   local file="$2"
   local expected="$3"
   download_package "$url" "$file" || return $?
-  checksum="$(compute_sha2 < "$file")"
+  checksum="$(compute_sha2 <"$file")"
   if [ "$checksum" != "$expected" ]; then
     {
       echo "Error: $url doesn't match its checksum:"
@@ -64,7 +64,7 @@ verify() {
     url="${url%#*}"
     echo "Verifying checksum for $url"
     file="${TMPDIR:-/tmp}/$checksum"
-    download_and_verify "$url" "$file" "$checksum" || (( status += 1))
+    download_and_verify "$url" "$file" "$checksum" || ((status += 1))
   done < <(xargs cat | extract_urls)
 
   if [ "$status" != 0 ]; then
@@ -74,23 +74,25 @@ verify() {
 }
 
 case "${1-}" in
-  '' )
-    { echo "COMMIT_RANGE or FILES required"
-      help_text
-    } >&2
-    exit 1;;
-  -h | --help )
+'')
+  {
+    echo "COMMIT_RANGE or FILES required"
     help_text
-    ;;
-  - )
-    verify
-    ;;
-  -- )
-    echo "$@" | verify
-    ;;
-  * )
-    echo "Verifying changes from $1"
-    changed_files "$1"
-    potentially_new_packages "$1" | verify
-    ;;
+  } >&2
+  exit 1
+  ;;
+-h | --help)
+  help_text
+  ;;
+-)
+  verify
+  ;;
+--)
+  echo "$@" | verify
+  ;;
+*)
+  echo "Verifying changes from $1"
+  changed_files "$1"
+  potentially_new_packages "$1" | verify
+  ;;
 esac
diff --git a/src/definition-graal.js b/src/definition-graal.js
index e17c70b..2c27ceb 100644
--- a/src/definition-graal.js
+++ b/src/definition-graal.js
@@ -5,9 +5,9 @@ module.exports = class GraalDefinition extends Definition {
     return ({ url, sha }) =>
       url.match(/\.tar\.gz$/)
         ? {
-          platform: this.platformFrom(url),
-          downloadUri: `${url}#${sha}`
-        }
+            platform: this.platformFrom(url),
+            downloadUri: `${url}#${sha}`
+          }
         : null
   }