diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 190a142..b3d55d0 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9dbe127..2214f08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+    branches: [main]
 
 permissions:
   contents: read
@@ -15,12 +16,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v4
         with:
           node-version: 24
           package-manager-cache: false
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 931ed8a..29091a8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,7 +18,7 @@ permissions:
   id-token: write
 
 concurrency:
-  group: npm-publish-${{ github.ref }}
+  group: npm-publish-${{ github.event.inputs.ref || github.ref }}
   cancel-in-progress: false
 
 jobs:
@@ -28,13 +28,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
-          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@v4
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49cc667..c542887 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.3.1] - 2026-06-06
+
+### Fixed
+
+- `ci.yml`: downgraded `actions/checkout@v6` / `actions/setup-node@v6` → `@v4` (v6 does not exist).
+- `ci.yml`: added `branches: [main]` filter to `pull_request` trigger.
+- `auto-release.yml`: replaced pinned SHA with `actions/checkout@v4`.
+- `publish.yml`: replaced pinned SHAs with `@v4`, fixed concurrency key to include `inputs.ref`.
+
 ## 0.3.0 - 2026-05-31
 
 - Define a session boundary policy that restores on `startup`/`resume` and reselects on `new`/`reload`/`fork` by default.
diff --git a/README.md b/README.md
index 235f6f6..6429c81 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,11 @@
 # pi-weighted-model-router
+[![CI](https://github.com/eiei114/pi-weighted-model-router/actions/workflows/ci.yml/badge.svg)](https://github.com/eiei114/pi-weighted-model-router/actions/workflows/ci.yml)
+[![Publish](https://github.com/eiei114/pi-weighted-model-router/actions/workflows/publish.yml/badge.svg)](https://github.com/eiei114/pi-weighted-model-router/actions/workflows/publish.yml)
+[![npm version](https://img.shields.io/npm/v/pi-weighted-model-router)](https://www.npmjs.com/package/pi-weighted-model-router)
+[![npm downloads](https://img.shields.io/npm/dw/pi-weighted-model-router)](https://www.npmjs.com/package/pi-weighted-model-router)
+[![License: MIT](https://img.shields.io/github/license/eiei114/pi-weighted-model-router)](https://github.com/eiei114/pi-weighted-model-router/blob/main/LICENSE)
+![Pi Package](https://img.shields.io/badge/Pi-Package-blue)
+[![Trusted Publishing](https://img.shields.io/badge/npm-provenance-yellow)](https://docs.npmjs.com/generating-provenance-statements)
 
 Pi extension that selects a model from weighted pools at session start, then keeps the session on that model unless a provider error or input capability requires fallback.
 
diff --git a/package.json b/package.json
index dbc7dab..9b7be42 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pi-weighted-model-router",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Pi extension that balances model/provider usage across weighted model pools.",
   "type": "module",
   "license": "MIT",