diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..7a7c12f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# Everything under .github/ decides what runs in CI, on which runner, and with
+# which secrets in scope. This repo accepts pull requests from outside
+# contributors, so a change here is a change to a trust boundary rather than to
+# the product. DevOps reviews it.
+.github/ @mindsdb/devops
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 28d9236..8628018 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -1,26 +1,19 @@
 name: "CLA Assistant"
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review:
-  
+
 permissions:
-  actions: write
+  actions: read
   contents: write
   pull-requests: write
   statuses: write
-    
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened,closed,synchronize]
+
 jobs:
   CLAssistant:
-    runs-on: mdb-dev
-    steps:
-      - name: "CLA Assistant"
-        if: (github.event.comment.body == 'recheckcla' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request'
-        uses: cla-assistant/github-action@v2.6.1
-        env: 
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}          
-        with: 
-          path-to-signatures: 'assets/contributions-agreement/signatures/cla.json'
-          path-to-document: 'https://github.com/mindsdb/mindsdb_native/blob/stable/assets/contributions-agreement/individual-contributor.md'
-          branch: 'staging'
-          allowlist: bot*, ZoranPandovski, torrmal, Stpmax, paxcema, mindsdbadmin, Ricram2, ea-rus, ilia-tsyplenkov, tomhuds
+    uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main
+    with:
+      path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md'