diff --git a/.github/workflows/go-security.yml b/.github/workflows/go-security.yml
index 6335d105..45d193c4 100644
--- a/.github/workflows/go-security.yml
+++ b/.github/workflows/go-security.yml
@@ -192,7 +192,7 @@ jobs:
           fetch-depth: 0
 
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.95.2
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
         with:
           path: ./
           base: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/self-pr-validation.yml b/.github/workflows/self-pr-validation.yml
index 267bdcae..cf553463 100644
--- a/.github/workflows/self-pr-validation.yml
+++ b/.github/workflows/self-pr-validation.yml
@@ -7,8 +7,10 @@ on:
       - main
     types:
       - opened
+      - edited
       - synchronize
       - reopened
+      - ready_for_review
   workflow_dispatch:
 
 permissions:
diff --git a/config/deployment-matrix.yml b/config/deployment-matrix.yml
index 6edf7992..45c1ad4e 100644
--- a/config/deployment-matrix.yml
+++ b/config/deployment-matrix.yml
@@ -41,6 +41,7 @@ apps:
     - reporter
     - tracer
     - product-console
+    - lerian-notification         # firmino-dev only today
 
     # Plugins
     - plugin-access-manager       # caller repo may push as plugin-identity / plugin-auth / casdoor
@@ -72,6 +73,7 @@ clusters:
       - reporter
       - tracer
       - product-console
+      - lerian-notification
       - plugin-access-manager
       - plugin-fees
       - plugin-br-pix-direct-jd