diff --git a/.github/workflows/release-cfl.yml b/.github/workflows/release-cfl.yml
index dccd6e32..d8041362 100644
--- a/.github/workflows/release-cfl.yml
+++ b/.github/workflows/release-cfl.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   release:
-    uses: open-cli-collective/.github/.github/workflows/release.yml@v1
+    uses: open-cli-collective/.github/.github/workflows/release.yml@6ee65fbc893f13b8876f013ec0661219a3e18269
     with:
       working-directory: tools/cfl
       # tag push is live (false); workflow_dispatch honors the checkbox. Compare
diff --git a/.github/workflows/release-jtk.yml b/.github/workflows/release-jtk.yml
index 6a4dc556..ffb4d6c5 100644
--- a/.github/workflows/release-jtk.yml
+++ b/.github/workflows/release-jtk.yml
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   release:
-    uses: open-cli-collective/.github/.github/workflows/release.yml@v1
+    uses: open-cli-collective/.github/.github/workflows/release.yml@6ee65fbc893f13b8876f013ec0661219a3e18269
     with:
       working-directory: tools/jtk
       # tag push is live (false); workflow_dispatch honors the checkbox. Compare
diff --git a/.github/workflows/test-winget.yml b/.github/workflows/test-winget.yml
index b7c3036b..bb3a6c4d 100644
--- a/.github/workflows/test-winget.yml
+++ b/.github/workflows/test-winget.yml
@@ -1,6 +1,10 @@
 name: Test Winget Manifests
 
 on:
+  pull_request:
+    paths:
+      - 'tools/*/packaging/winget/**'
+      - '.github/workflows/test-winget.yml'
   push:
     branches: [main]
     paths:
@@ -12,6 +16,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install current WinGet validator
+        shell: pwsh
+        run: |
+          $bundle = Join-Path $env:RUNNER_TEMP "Microsoft.DesktopAppInstaller.msixbundle"
+          Invoke-WebRequest "https://github.com/microsoft/winget-cli/releases/download/v1.29.380/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle" -OutFile $bundle
+          $expected = "65dea9c01ce08ee7b763366b27c0e651f97db857c11ca9b9c301826c10092f2e"
+          if ((Get-FileHash $bundle -Algorithm SHA256).Hash -ne $expected) { throw "WinGet bundle checksum mismatch" }
+          $deps = Join-Path $env:RUNNER_TEMP "winget-dependencies.zip"
+          Invoke-WebRequest "https://github.com/microsoft/winget-cli/releases/download/v1.29.380/DesktopAppInstaller_Dependencies.zip" -OutFile $deps
+          $depsHash = "ba875afe9d190f61218985ac0292a99d1db710bf93e13c68944ca9d89f0d82d1"
+          if ((Get-FileHash $deps -Algorithm SHA256).Hash -ne $depsHash) { throw "WinGet dependencies checksum mismatch" }
+          $depsDir = Join-Path $env:RUNNER_TEMP "winget-dependencies"
+          Expand-Archive -Path $deps -DestinationPath $depsDir
+          $dependencyPaths = @(Get-ChildItem (Join-Path $depsDir "x64") -Filter "*.appx" | ForEach-Object FullName)
+          Add-AppxPackage -Path $bundle -DependencyPath $dependencyPaths
+          winget --version
+
       - name: Validate manifest schema
         shell: pwsh
         run: |
@@ -53,6 +74,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install current WinGet validator
+        shell: pwsh
+        run: |
+          $bundle = Join-Path $env:RUNNER_TEMP "Microsoft.DesktopAppInstaller.msixbundle"
+          Invoke-WebRequest "https://github.com/microsoft/winget-cli/releases/download/v1.29.380/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle" -OutFile $bundle
+          $expected = "65dea9c01ce08ee7b763366b27c0e651f97db857c11ca9b9c301826c10092f2e"
+          if ((Get-FileHash $bundle -Algorithm SHA256).Hash -ne $expected) { throw "WinGet bundle checksum mismatch" }
+          $deps = Join-Path $env:RUNNER_TEMP "winget-dependencies.zip"
+          Invoke-WebRequest "https://github.com/microsoft/winget-cli/releases/download/v1.29.380/DesktopAppInstaller_Dependencies.zip" -OutFile $deps
+          $depsHash = "ba875afe9d190f61218985ac0292a99d1db710bf93e13c68944ca9d89f0d82d1"
+          if ((Get-FileHash $deps -Algorithm SHA256).Hash -ne $depsHash) { throw "WinGet dependencies checksum mismatch" }
+          $depsDir = Join-Path $env:RUNNER_TEMP "winget-dependencies"
+          Expand-Archive -Path $deps -DestinationPath $depsDir
+          $dependencyPaths = @(Get-ChildItem (Join-Path $depsDir "x64") -Filter "*.appx" | ForEach-Object FullName)
+          Add-AppxPackage -Path $bundle -DependencyPath $dependencyPaths
+          winget --version
+
       - name: Validate manifest schema
         shell: pwsh
         run: |
diff --git a/.github/workflows/winget-publish-cfl.yml b/.github/workflows/winget-publish-cfl.yml
index b65108ab..0303ec11 100644
--- a/.github/workflows/winget-publish-cfl.yml
+++ b/.github/workflows/winget-publish-cfl.yml
@@ -8,23 +8,22 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Install wingetcreate
-        run: |
-          iwr https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
-
-      - name: Update manifest
-        env:
-          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
-        run: |
-          $version = "${{ inputs.version }}"
-          $baseUrl = "https://github.com/open-cli-collective/atlassian-cli/releases/download/cfl-v$version"
-          ./wingetcreate.exe update OpenCLICollective.cfl `
-            --version $version `
-            --urls "$baseUrl/cfl_${version}_windows_amd64.zip|x64" "$baseUrl/cfl_${version}_windows_arm64.zip|arm64" `
-            --submit
+      - name: Submit WinGet package
+        uses: open-cli-collective/.github/actions/winget-submit@6ee65fbc893f13b8876f013ec0661219a3e18269
+        with:
+          package-id: OpenCLICollective.cfl
+          version: ${{ inputs.version }}
+          final-tag: cfl-v${{ inputs.version }}
+          repo: ${{ github.repository }}
+          working-directory: tools/cfl
+          bootstrap: "false"
+          github-token: ${{ github.token }}
+          winget-token: ${{ secrets.WINGET_GITHUB_TOKEN }}
diff --git a/.github/workflows/winget-publish-jtk.yml b/.github/workflows/winget-publish-jtk.yml
index 555af1f5..2801a84f 100644
--- a/.github/workflows/winget-publish-jtk.yml
+++ b/.github/workflows/winget-publish-jtk.yml
@@ -8,23 +8,22 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Install wingetcreate
-        run: |
-          iwr https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
-
-      - name: Update manifest
-        env:
-          WINGET_CREATE_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
-        run: |
-          $version = "${{ inputs.version }}"
-          $baseUrl = "https://github.com/open-cli-collective/atlassian-cli/releases/download/jtk-v$version"
-          ./wingetcreate.exe update OpenCLICollective.jira-ticket-cli `
-            --version $version `
-            --urls "$baseUrl/jtk_${version}_windows_amd64.zip|x64" "$baseUrl/jtk_${version}_windows_arm64.zip|arm64" `
-            --submit
+      - name: Submit WinGet package
+        uses: open-cli-collective/.github/actions/winget-submit@6ee65fbc893f13b8876f013ec0661219a3e18269
+        with:
+          package-id: OpenCLICollective.jira-ticket-cli
+          version: ${{ inputs.version }}
+          final-tag: jtk-v${{ inputs.version }}
+          repo: ${{ github.repository }}
+          working-directory: tools/jtk
+          bootstrap: "false"
+          github-token: ${{ github.token }}
+          winget-token: ${{ secrets.WINGET_GITHUB_TOKEN }}
diff --git a/tools/cfl/packaging/winget/OpenCLICollective.cfl.installer.yaml b/tools/cfl/packaging/winget/OpenCLICollective.cfl.installer.yaml
index 5d05ec03..bf8efad1 100644
--- a/tools/cfl/packaging/winget/OpenCLICollective.cfl.installer.yaml
+++ b/tools/cfl/packaging/winget/OpenCLICollective.cfl.installer.yaml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.cfl
 PackageVersion: 0.0.0
@@ -15,4 +15,4 @@ Installers:
     InstallerUrl: https://github.com/open-cli-collective/atlassian-cli/releases/download/cfl-v0.0.0/cfl_0.0.0_windows_arm64.zip
     InstallerSha256: 0000000000000000000000000000000000000000000000000000000000000000
 ManifestType: installer
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0
diff --git a/tools/cfl/packaging/winget/OpenCLICollective.cfl.locale.en-US.yaml b/tools/cfl/packaging/winget/OpenCLICollective.cfl.locale.en-US.yaml
index ed589764..8e786d6e 100644
--- a/tools/cfl/packaging/winget/OpenCLICollective.cfl.locale.en-US.yaml
+++ b/tools/cfl/packaging/winget/OpenCLICollective.cfl.locale.en-US.yaml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.cfl
 PackageVersion: 0.0.0
@@ -24,4 +24,4 @@ Tags:
   - documentation
 ReleaseNotesUrl: https://github.com/open-cli-collective/atlassian-cli/releases
 ManifestType: defaultLocale
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0
diff --git a/tools/cfl/packaging/winget/OpenCLICollective.cfl.yaml b/tools/cfl/packaging/winget/OpenCLICollective.cfl.yaml
index 5a5fdd24..8944e1fc 100644
--- a/tools/cfl/packaging/winget/OpenCLICollective.cfl.yaml
+++ b/tools/cfl/packaging/winget/OpenCLICollective.cfl.yaml
@@ -1,7 +1,7 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.cfl
 PackageVersion: 0.0.0
 DefaultLocale: en-US
 ManifestType: version
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0
diff --git a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.installer.yaml b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.installer.yaml
index 298439e3..6b21d313 100644
--- a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.installer.yaml
+++ b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.installer.yaml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.jira-ticket-cli
 PackageVersion: 0.0.0
@@ -15,4 +15,4 @@ Installers:
     InstallerUrl: https://github.com/open-cli-collective/atlassian-cli/releases/download/jtk-v0.0.0/jtk_0.0.0_windows_arm64.zip
     InstallerSha256: CHECKSUM_ARM64_PLACEHOLDER
 ManifestType: installer
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0
diff --git a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.locale.en-US.yaml b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.locale.en-US.yaml
index 6756d4e4..6b85a818 100644
--- a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.locale.en-US.yaml
+++ b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.locale.en-US.yaml
@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.jira-ticket-cli
 PackageVersion: 0.0.0
@@ -23,4 +23,4 @@ Tags:
   - agile
 ReleaseNotesUrl: https://github.com/open-cli-collective/atlassian-cli/releases
 ManifestType: defaultLocale
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0
diff --git a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.yaml b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.yaml
index 07a03c82..a86ce187 100644
--- a/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.yaml
+++ b/tools/jtk/packaging/winget/OpenCLICollective.jira-ticket-cli.yaml
@@ -1,7 +1,7 @@
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.10.0.schema.json
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.28.0.schema.json
 
 PackageIdentifier: OpenCLICollective.jira-ticket-cli
 PackageVersion: 0.0.0
 DefaultLocale: en-US
 ManifestType: version
-ManifestVersion: 1.10.0
+ManifestVersion: 1.28.0