diff --git a/.github/workflows/docs-update.yaml b/.github/workflows/docs-update.yaml
index 7d4fbc2de3..d8d27d4a97 100644
--- a/.github/workflows/docs-update.yaml
+++ b/.github/workflows/docs-update.yaml
@@ -15,13 +15,13 @@ jobs:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          token: ${{ secrets.GH_PUSH_TOKEN }}
+          token: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
           persist-credentials: false
 
       - name: Get latest Regal release
         id: latest
         env:
-          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
         run: |
           LATEST_VERSION=$(gh api repos/open-policy-agent/regal/releases/latest --jq '.tag_name')
           echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
@@ -115,7 +115,7 @@ jobs:
       - name: Create pull request
         if: steps.check.outputs.needed == 'true' && steps.changes.outputs.has_changes == 'true'
         env:
-          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
           STEPS_LATEST_OUTPUTS_VERSION: ${{ steps.latest.outputs.version }}
         run: |
           VERSION="${STEPS_LATEST_OUTPUTS_VERSION}"
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index f6d5379e4c..c9f1ba4b04 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -4,9 +4,9 @@ on:
   schedule:
     - cron:  '0 8 * * 0-4' # Sun-Thu, at 8:00 UTC
 
-permissions: 
+permissions:
   contents: read
-  
+
 jobs:
   race-detector:
     name: Go Race Detector
@@ -22,11 +22,9 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {
@@ -60,11 +58,9 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {
@@ -88,11 +84,9 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {
@@ -119,11 +113,142 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
+            }
+
+  test-ocp-with-opa-main:
+    name: Test OCP with OPA main
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out OPA code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: opa
+
+      - id: go_version
+        name: Read go version
+        run: echo "go_version=$(cat opa/.go-version)" >> $GITHUB_OUTPUT
+
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+
+      - name: Get latest OCP release tag
+        id: ocp_release
+        run: |
+          tag=$(gh api repos/open-policy-agent/opa-control-plane/releases/latest --jq '.tag_name')
+          echo "tag=$tag" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Check out OCP ${{ steps.ocp_release.outputs.tag }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: open-policy-agent/opa-control-plane
+          ref: ${{ steps.ocp_release.outputs.tag }}
+          persist-credentials: false
+          path: ocp
+
+      - name: Update OPA to main
+        working-directory: ocp
+        run: |
+          go mod edit -replace github.com/open-policy-agent/opa=../opa
+          go mod tidy
+
+      - name: Build
+        working-directory: ocp
+        run: make build
+
+      - name: Test
+        working-directory: ocp
+        run: make test
+
+      - name: e2e tests
+        working-directory: ocp
+        run: |
+          set -euo pipefail
+          matches=(opactl_*)
+          export OPACTL="$(pwd)/${matches[0]}"
+          $OPACTL version
+          go test -tags=e2e ./e2e/... -v
+
+      - name: Slack Notification
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
+        with:
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
+            }
+
+  test-regal-with-opa-main:
+    name: Test Regal with OPA main
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out OPA code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: opa
+
+      - id: go_version
+        name: Read go version
+        run: echo "go_version=$(cat opa/.go-version)" >> $GITHUB_OUTPUT
+
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+
+      - name: Get latest Regal release tag
+        id: regal_release
+        run: |
+          tag=$(gh api repos/open-policy-agent/regal/releases/latest --jq '.tag_name')
+          echo "tag=$tag" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Check out Regal ${{ steps.regal_release.outputs.tag }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: open-policy-agent/regal
+          ref: ${{ steps.regal_release.outputs.tag }}
+          persist-credentials: false
+          path: regal
+
+      - name: Update OPA to main
+        working-directory: regal
+        run: |
+          go mod edit -replace github.com/open-policy-agent/opa=../opa
+          go mod tidy
+
+      - name: Build
+        working-directory: regal
+        run: go build -tags=regal_standalone
+
+      - name: Test
+        working-directory: regal
+        run: go test ./...
+
+      - name: e2e tests
+        working-directory: regal
+        run: go test -tags e2e ./e2e -count=1
+
+      - name: Slack Notification
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
+        with:
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {
@@ -170,11 +295,9 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {
diff --git a/.github/workflows/post-merge.yaml b/.github/workflows/post-merge.yaml
index ef38bf32db..bbcfa0b699 100644
--- a/.github/workflows/post-merge.yaml
+++ b/.github/workflows/post-merge.yaml
@@ -18,7 +18,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          token: ${{ secrets.GH_PUSH_TOKEN }} # required to push to protected branch below
+          token: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env] required to push to protected branch below
           persist-credentials: true
 
       - name: Generate
@@ -194,12 +194,12 @@ jobs:
 
       - name: Deploy OPA Edge
         env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
-          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} # zizmor: ignore[secrets-outside-env]
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }} # zizmor: ignore[secrets-outside-env]
+          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }} # zizmor: ignore[secrets-outside-env]
         # Only run if required secrets are provided
         if: ${{ env.S3_RELEASE_BUCKET && env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY && env.DOCKER_USER && env.DOCKER_PASSWORD }}
         run: make deploy-ci
@@ -216,9 +216,9 @@ jobs:
 
       - name: Build and Push opa-wasm-builder
         env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_WASM_BUILDER_IMAGE: ${{ secrets.DOCKER_WASM_BUILDER_IMAGE }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_WASM_BUILDER_IMAGE: ${{ secrets.DOCKER_WASM_BUILDER_IMAGE }} # zizmor: ignore[secrets-outside-env]
         # Only run if required secrets are provided
         if: ${{ env.DOCKER_USER && env.DOCKER_PASSWORD }}
         run: make push-wasm-builder-image
diff --git a/.github/workflows/post-tag.yaml b/.github/workflows/post-tag.yaml
index 535e98652a..09902ca8c4 100644
--- a/.github/workflows/post-tag.yaml
+++ b/.github/workflows/post-tag.yaml
@@ -136,9 +136,9 @@ jobs:
       - name: Build and Deploy OPA Docker Images
         id: build-and-deploy
         env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }} # zizmor: ignore[secrets-outside-env]
         # Only run if required secrets are provided
         if: ${{ env.DOCKER_USER && env.DOCKER_PASSWORD }}
         run: make release-ci
diff --git a/.github/workflows/release-vulnerability-check.yaml b/.github/workflows/release-vulnerability-check.yaml
index 4e1936bbf5..55cf282567 100644
--- a/.github/workflows/release-vulnerability-check.yaml
+++ b/.github/workflows/release-vulnerability-check.yaml
@@ -49,11 +49,9 @@ jobs:
 
       - name: Slack Notification
         uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
         with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
           webhook-type: incoming-webhook
           payload: |
             {