diff --git a/.github/workflows/reusable-deploy-multidev.yml b/.github/workflows/reusable-deploy-multidev.yml
index 92fceb1..363660f 100644
--- a/.github/workflows/reusable-deploy-multidev.yml
+++ b/.github/workflows/reusable-deploy-multidev.yml
@@ -21,16 +21,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      PANTHEON_MACHINE_TOKEN:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -54,9 +47,24 @@ jobs:
         # Use shallow clone to let pantheon action handle unshallowing
         fetch-depth: 1
 
+    - name: Configure 1Password
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+        PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+        CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+        CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+
     - name: Install Terminus
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TERMINUS_VERSION=$(curl -s https://api.github.com/repos/pantheon-systems/terminus/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
         curl -fsSL "https://github.com/pantheon-systems/terminus/releases/download/${TERMINUS_VERSION}/terminus.phar" -o /usr/local/bin/terminus
@@ -67,7 +75,7 @@ jobs:
     - name: Determine source environment
       id: source_env
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TARGET_ENV="${{ inputs.target_env }}"
 
@@ -94,7 +102,7 @@ jobs:
     - name: Check if multidev environment exists
       id: check_env
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         echo "Checking if environment ${{ inputs.pantheon_site }}.${{ inputs.target_env }} exists..."
         terminus env:info ${{ inputs.pantheon_site }}.${{ inputs.target_env }} && ENV_EXISTS=true || ENV_EXISTS=false
@@ -138,8 +146,8 @@ jobs:
       env:
         COMPOSER_NO_SECURITY_BLOCKING: 1
       with:
-        ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-        machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+        machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
         site: ${{ inputs.pantheon_site }}
         target_env: ${{ inputs.target_env }}
         source_env: ${{ steps.source_env.outputs.source_env }}
@@ -153,7 +161,7 @@ jobs:
       if: ${{ !inputs.workflow_skip_terminus }}
       id: drush_commands
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         # Check PR title for order preference and verbosity
         # Use HERE document to safely handle all special characters
@@ -184,7 +192,7 @@ jobs:
     - name: Get multidev URL
       id: multidev_url
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         URL=$(terminus env:view ${{ inputs.pantheon_site }}.${{ inputs.target_env }} --print)
         echo "url=$URL" >> $GITHUB_OUTPUT
@@ -194,8 +202,8 @@ jobs:
       id: clickup_comment
       continue-on-error: true
       env:
-        CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-        CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
+        CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+        CLICKUP_TEAM_ID: ${{ env.CLICKUP_TEAM_ID }}
       run: |
         set -x
         if [[ -z "$CLICKUP_API_TOKEN" || -z "$CLICKUP_TEAM_ID" ]]; then
@@ -291,7 +299,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+    - name: Configure 1Password
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
     - name: Send Slack notification
+      env:
+        SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
       run: |
         # Determine status and message
         if [[ "${{ needs.deploy_to_multidev.result }}" == "success" ]]; then
@@ -343,8 +365,8 @@ jobs:
         fi
 
         # Send to Slack using Bot API
-        if [[ -n "${{ secrets.SLACK_BOT_TOKEN }}" ]]; then
-          curl -X POST -H "Authorization: Bearer ${{ secrets.SLACK_BOT_TOKEN }}" \
+        if [[ -n "$SLACK_BOT_TOKEN" ]]; then
+          curl -X POST -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
             -H 'Content-type: application/json; charset=utf-8' \
             --data "{
               \"channel\": \"${{ inputs.slack_channel }}\",
diff --git a/.github/workflows/reusable-pantheon-deploy-dev.yml b/.github/workflows/reusable-pantheon-deploy-dev.yml
index 72c0a3c..a3d9285 100644
--- a/.github/workflows/reusable-pantheon-deploy-dev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-dev.yml
@@ -16,6 +16,11 @@ name: Reusable Deploy to Pantheon DEV
 #
 # PR-title flag support is delegated to pantheon-post-deploy-drush:
 #   [verbose]  — pass -v to drush deploy
+#
+# v4: secrets loaded from 1Password via OP_SERVICE_ACCOUNT_TOKEN.
+#     The only GitHub secret required is OP_SERVICE_ACCOUNT_TOKEN (org-level).
+#     All other credentials (Pantheon, Slack) are resolved at runtime from
+#     the s360-cicd vault.
 # -----------------------------------------------------------------------------
 
 on:
@@ -45,14 +50,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
-        required: true
-      PANTHEON_MACHINE_TOKEN:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      CI_GH_TOKEN:
-        required: false
-      SLACK_BOT_TOKEN:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -62,9 +62,9 @@ jobs:
   semantic_release:
     name: Semantic Release
     if: ${{ inputs.run_semantic_release }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-semantic-release.yml@v4.0.0-beta.1
     secrets:
-      CI_GH_TOKEN: ${{ secrets.CI_GH_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   deploy_to_pantheon_dev:
     name: Deploy to Pantheon DEV
@@ -91,10 +91,23 @@ jobs:
           # Shallow clone — pantheon-systems/push-to-pantheon handles unshallowing.
           fetch-depth: 1
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+          PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v4.0.0-beta.1
         with:
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       # -----------------------------------------------------------------------
       # Push code to Pantheon DEV. target_env is hardcoded; source_env is
@@ -102,12 +115,12 @@ jobs:
       # -----------------------------------------------------------------------
       - name: Push code to Pantheon DEV
         id: deploy_pantheon
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v4.0.0-beta.1
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: dev
-          ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       # -----------------------------------------------------------------------
       # Backup-on-live safety net: if the last live backup is older than the
@@ -122,7 +135,7 @@ jobs:
       - name: Check last live backup age
         id: last_backup
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           THRESHOLD_HOURS: ${{ inputs.backup_hours_threshold }}
         run: |
@@ -150,7 +163,7 @@ jobs:
         id: create_backup
         if: ${{ steps.last_backup.outputs.needs_backup == 'true' }}
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
         run: |
           echo "Creating backup on live (keep-for 30 days)"
@@ -159,18 +172,18 @@ jobs:
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v4.0.0-beta.1
         with:
           site: ${{ inputs.pantheon_site }}
           env: dev
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           skip: ${{ inputs.workflow_skip_terminus }}
           pr_title: ${{ github.event.pull_request.title }}
 
       - name: Get environment URL
         id: env_url
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
         run: |
           URL=$(terminus env:view "${SITE}.dev" --print)
@@ -207,9 +220,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
       - name: Send Slack notification
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
           SLACK_CHANNEL: ${{ inputs.slack_channel }}
           SEMANTIC_RESULT: ${{ needs.semantic_release.result }}
           DEPLOY_RESULT: ${{ needs.deploy_to_pantheon_dev.result }}
diff --git a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
index 5901f7d..a8db26c 100644
--- a/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-epic-multidev.yml
@@ -41,24 +41,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      PANTHEON_MACHINE_TOKEN:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
-      AWS_ACCESS_KEY_ID:
-        required: false
-      AWS_SECRET_ACCESS_KEY:
-        required: false
-      AWS_S3_BUCKET:
-        required: false
-      AWS_S3_REGION:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -85,6 +70,21 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+          PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+          CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+          CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+
       - name: Derive multidev name from epic branch
         id: derive
         env:
@@ -126,14 +126,14 @@ jobs:
           echo "Epic multidev: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v4.0.0-beta.3
         with:
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       - name: Check if epic multidev environment exists
         id: check_env
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
         run: |
@@ -148,22 +148,22 @@ jobs:
 
       - name: Push code to Pantheon epic multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
           source_env: dev
-          ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           commit_message: 'Automated deployment from GitHub Actions to epic multidev ${{ steps.derive.outputs.target_env }}'
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           skip: ${{ inputs.workflow_skip_terminus }}
           # No pr_title for push events; [verbose] flag doesn't apply.
           pr_title: ''
@@ -171,7 +171,7 @@ jobs:
       - name: Get epic multidev URL
         id: multidev_url
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
         run: |
@@ -182,8 +182,8 @@ jobs:
       - name: Comment on ClickUp epic ticket with multidev URL
         continue-on-error: true
         env:
-          CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-          CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
+          CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+          CLICKUP_TEAM_ID: ${{ env.CLICKUP_TEAM_ID }}
           MULTIDEV_URL: ${{ steps.multidev_url.outputs.url }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
           ENV_IS_NEW: ${{ steps.check_env.outputs.env_is_new }}
@@ -234,24 +234,13 @@ jobs:
     # The security workflow detects epr-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding) — same gate as rc-*,
     # per the Square360 SOP for epic integration multidevs. No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v4.0.0-beta.3
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_epic_multidev.outputs.target_env }}
       slack_channel: ${{ inputs.slack_channel }}
-    # `secrets: inherit` only forwards secrets defined on the calling workflow's
-    # own repo/org. Since this reusable workflow is called cross-org from
-    # consumer Drupal sites, the inherited secrets aren't ours to forward —
-    # explicit pass-through is required.
     secrets:
-      PANTHEON_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-      AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
-      CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-      CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   notify_slack:
     name: Notify Slack
@@ -259,9 +248,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
       - name: Send Slack notification
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
           SLACK_CHANNEL: ${{ inputs.slack_channel }}
           DEPLOY_RESULT: ${{ needs.deploy_epic_multidev.result }}
           MULTIDEV_URL: ${{ needs.deploy_epic_multidev.outputs.multidev_url }}
diff --git a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
index 2f0d1d8..b09f05d 100644
--- a/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-pr-multidev.yml
@@ -33,24 +33,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      PANTHEON_MACHINE_TOKEN:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
-      AWS_ACCESS_KEY_ID:
-        required: false
-      AWS_SECRET_ACCESS_KEY:
-        required: false
-      AWS_S3_BUCKET:
-        required: false
-      AWS_S3_REGION:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -78,19 +63,34 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+          PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+          CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+          CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+
       - name: Derive multidev name from PR number
         id: derive
         run: echo "target_env=pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v4.0.0-beta.3
         with:
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       - name: Check if multidev environment exists
         id: check_env
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
         run: |
@@ -105,29 +105,29 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
           source_env: dev
-          ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           commit_message: 'Automated deployment from GitHub Actions to multidev ${{ steps.derive.outputs.target_env }}'
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           skip: ${{ inputs.workflow_skip_terminus }}
           pr_title: ${{ github.event.pull_request.title }}
 
       - name: Get multidev URL
         id: multidev_url
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
         run: |
@@ -138,8 +138,8 @@ jobs:
       - name: Comment on ClickUp task with multidev URL
         continue-on-error: true
         env:
-          CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-          CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
+          CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+          CLICKUP_TEAM_ID: ${{ env.CLICKUP_TEAM_ID }}
           MULTIDEV_URL: ${{ steps.multidev_url.outputs.url }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
           ENV_IS_NEW: ${{ steps.check_env.outputs.env_is_new }}
@@ -228,24 +228,13 @@ jobs:
         contains(github.event.pull_request.body, '[run-security]') ||
         contains(github.event.pull_request.body, '[security]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v4.0.0-beta.3
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
       slack_channel: ${{ inputs.slack_channel }}
-    # `secrets: inherit` only forwards secrets defined on the calling workflow's
-    # own repo/org. Since this reusable workflow is called cross-org from
-    # consumer Drupal sites, the inherited secrets aren't ours to forward —
-    # explicit pass-through is required.
     secrets:
-      PANTHEON_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-      AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
-      CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-      CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   visual_regression:
     name: Visual Regression (opt-in)
@@ -256,21 +245,13 @@ jobs:
         contains(github.event.pull_request.body, '[run-vrt]') ||
         contains(github.event.pull_request.body, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v4.0.0-beta.3
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_pr_multidev.outputs.target_env }}
       slack_channel: ${{ inputs.slack_channel }}
-    # See note above the security_scan job's secrets block — same constraint.
     secrets:
-      PANTHEON_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-      AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
-      CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-      CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   notify_slack:
     name: Notify Slack
@@ -278,9 +259,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
       - name: Send Slack notification
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
           SLACK_CHANNEL: ${{ inputs.slack_channel }}
           DEPLOY_RESULT: ${{ needs.deploy_pr_multidev.result }}
           MULTIDEV_URL: ${{ needs.deploy_pr_multidev.outputs.multidev_url }}
diff --git a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
index 3d5e328..af03088 100644
--- a/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
+++ b/.github/workflows/reusable-pantheon-deploy-rc-multidev.yml
@@ -36,24 +36,9 @@ on:
         type: boolean
         default: false
     secrets:
-      PANTHEON_SSH_KEY:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      PANTHEON_MACHINE_TOKEN:
-        required: true
-      SLACK_BOT_TOKEN:
-        required: false
-      AWS_ACCESS_KEY_ID:
-        required: false
-      AWS_SECRET_ACCESS_KEY:
-        required: false
-      AWS_S3_BUCKET:
-        required: false
-      AWS_S3_REGION:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -78,6 +63,19 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+          PANTHEON_SSH_KEY: op://s360-cicd/pantheon/ssh-key
+
       - name: Derive multidev name from ISO week
         id: derive
         run: |
@@ -88,14 +86,14 @@ jobs:
           echo "Derived RC multidev name: ${TARGET_ENV}"
 
       - name: Install Terminus
-        uses: Square360/shared-workflows/.github/actions/terminus-install@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/terminus-install@v4.0.0-beta.3
         with:
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
 
       - name: Determine source environment
         id: source_env
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
         run: |
           # RC multidevs prefer live as the source (so the RC starts from the
@@ -111,22 +109,22 @@ jobs:
 
       - name: Push code to Pantheon multidev
         id: deploy
-        uses: Square360/shared-workflows/.github/actions/pantheon-push@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-push@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           target_env: ${{ steps.derive.outputs.target_env }}
           source_env: ${{ steps.source_env.outputs.source_env }}
-          ssh_key: ${{ secrets.PANTHEON_SSH_KEY }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          ssh_key: ${{ env.PANTHEON_SSH_KEY }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           commit_message: 'Automated deployment from GitHub Actions to RC multidev ${{ steps.derive.outputs.target_env }}'
 
       - name: Run post-deploy drush commands
         id: drush_commands
-        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v3.2.6
+        uses: Square360/shared-workflows/.github/actions/pantheon-post-deploy-drush@v4.0.0-beta.3
         with:
           site: ${{ inputs.pantheon_site }}
           env: ${{ steps.derive.outputs.target_env }}
-          machine_token: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          machine_token: ${{ env.PANTHEON_MACHINE_TOKEN }}
           skip: ${{ inputs.workflow_skip_terminus }}
           # No pr_title for push events; [verbose] flag doesn't apply here.
           pr_title: ''
@@ -134,7 +132,7 @@ jobs:
       - name: Get multidev URL
         id: multidev_url
         env:
-          TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+          TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
           SITE: ${{ inputs.pantheon_site }}
           TARGET_ENV: ${{ steps.derive.outputs.target_env }}
         run: |
@@ -165,22 +163,13 @@ jobs:
     needs: deploy_rc_multidev
     # The security workflow detects rc-* internally and runs unconditionally
     # in strict mode (fails on any High-severity finding). No force_run needed.
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-security-scan.yml@v4.0.0-beta.3
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
       slack_channel: ${{ inputs.slack_channel }}
-    # `secrets: inherit` only forwards secrets defined on the calling workflow's
-    # own repo/org. Since this reusable workflow is called cross-org from
-    # consumer Drupal sites, the inherited secrets aren't ours to forward —
-    # explicit pass-through is required.
     secrets:
-      PANTHEON_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-      AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   visual_regression:
     name: Visual Regression (opt-in)
@@ -193,7 +182,7 @@ jobs:
         contains(github.event.head_commit.message, '[run-vrt]') ||
         contains(github.event.head_commit.message, '[vrt]')
       }}
-    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v3.2.6
+    uses: Square360/shared-workflows/.github/workflows/reusable-pantheon-vrt.yml@v4.0.0-beta.3
     with:
       pantheon_site: ${{ inputs.pantheon_site }}
       target_env: ${{ needs.deploy_rc_multidev.outputs.target_env }}
@@ -202,16 +191,8 @@ jobs:
       # on push events. We've already gated this job on the commit message
       # above, so tell VRT to skip its own check and just run.
       force_run: true
-    # See note above the security_scan job's secrets block — same constraint.
     secrets:
-      PANTHEON_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-      AWS_S3_REGION: ${{ secrets.AWS_S3_REGION }}
-      CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-      CLICKUP_TEAM_ID: ${{ secrets.CLICKUP_TEAM_ID }}
-      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
   notify_slack:
     name: Notify Slack
@@ -219,9 +200,21 @@ jobs:
     if: ${{ always() && inputs.slack_channel }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
       - name: Send Slack notification
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ env.SLACK_BOT_TOKEN }}
           SLACK_CHANNEL: ${{ inputs.slack_channel }}
           DEPLOY_RESULT: ${{ needs.deploy_rc_multidev.result }}
           MULTIDEV_URL: ${{ needs.deploy_rc_multidev.outputs.multidev_url }}
diff --git a/.github/workflows/reusable-pantheon-security-scan.yml b/.github/workflows/reusable-pantheon-security-scan.yml
index 971c3a5..579f5f9 100644
--- a/.github/workflows/reusable-pantheon-security-scan.yml
+++ b/.github/workflows/reusable-pantheon-security-scan.yml
@@ -54,22 +54,9 @@ on:
         type: string
         default: ''
     secrets:
-      PANTHEON_MACHINE_TOKEN:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      AWS_ACCESS_KEY_ID:
-        required: true
-      AWS_SECRET_ACCESS_KEY:
-        required: true
-      AWS_S3_BUCKET:
-        required: true
-      AWS_S3_REGION:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
-      SLACK_BOT_TOKEN:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -174,10 +161,31 @@ jobs:
       if: steps.sec_check.outputs.enabled == 'true'
       uses: actions/checkout@v6
 
+    - name: Configure 1Password
+      if: steps.sec_check.outputs.enabled == 'true'
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      if: steps.sec_check.outputs.enabled == 'true'
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+        AWS_ACCESS_KEY_ID: op://s360-cicd/aws-ci/access-key-id
+        AWS_SECRET_ACCESS_KEY: op://s360-cicd/aws-ci/secret-access-key
+        AWS_S3_BUCKET: op://s360-cicd/aws-ci/s3-bucket
+        AWS_S3_REGION: op://s360-cicd/aws-ci/s3-region
+        CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+        CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+        SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
     - name: Install Terminus
       if: steps.sec_check.outputs.enabled == 'true'
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TERMINUS_VERSION=$(curl -s https://api.github.com/repos/pantheon-systems/terminus/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
         curl -fsSL "https://github.com/pantheon-systems/terminus/releases/download/${TERMINUS_VERSION}/terminus.phar" \
@@ -221,8 +229,8 @@ jobs:
       id: s3_urls
       if: steps.sec_check.outputs.enabled == 'true'
       env:
-        AWS_S3_BUCKET:       ${{ secrets.AWS_S3_BUCKET }}
-        AWS_S3_REGION_INPUT: ${{ secrets.AWS_S3_REGION }}
+        AWS_S3_BUCKET:       ${{ env.AWS_S3_BUCKET }}
+        AWS_S3_REGION_INPUT: ${{ env.AWS_S3_REGION }}
         PANTHEON_SITE:       ${{ inputs.pantheon_site }}
       run: |
         REGION="${AWS_S3_REGION_INPUT:-us-east-1}"
@@ -393,10 +401,10 @@ jobs:
       id: s3_upload
       if: steps.sec_check.outputs.enabled == 'true'
       env:
-        AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        AWS_S3_BUCKET:         ${{ secrets.AWS_S3_BUCKET }}
-        AWS_S3_REGION_INPUT:   ${{ secrets.AWS_S3_REGION }}
+        AWS_ACCESS_KEY_ID:     ${{ env.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
+        AWS_S3_BUCKET:         ${{ env.AWS_S3_BUCKET }}
+        AWS_S3_REGION_INPUT:   ${{ env.AWS_S3_REGION }}
         PANTHEON_SITE:         ${{ inputs.pantheon_site }}
         RUN_KEY:               ${{ steps.s3_urls.outputs.run_key }}
         BASE_URL:              ${{ steps.s3_urls.outputs.base_url }}
@@ -551,8 +559,8 @@ jobs:
         steps.sec_check.outputs.clickup_task_id != ''
       continue-on-error: true
       env:
-        CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-        CLICKUP_TEAM_ID:   ${{ secrets.CLICKUP_TEAM_ID }}
+        CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+        CLICKUP_TEAM_ID:   ${{ env.CLICKUP_TEAM_ID }}
         TASK_ID:           ${{ steps.sec_check.outputs.clickup_task_id }}
         REPORT_HTML_URL:   ${{ steps.s3_upload.outputs.report_html_url }}
         REPORT_JSON_URL:   ${{ steps.s3_upload.outputs.report_json_url }}
@@ -655,7 +663,7 @@ jobs:
         steps.sec_check.outputs.enabled == 'true' &&
         inputs.slack_channel != ''
       env:
-        SLACK_BOT_TOKEN:  ${{ secrets.SLACK_BOT_TOKEN }}
+        SLACK_BOT_TOKEN:  ${{ env.SLACK_BOT_TOKEN }}
         SLACK_CHANNEL:    ${{ inputs.slack_channel }}
         REPORT_HTML_URL:  ${{ steps.s3_upload.outputs.report_html_url }}
         REPORT_JSON_URL:  ${{ steps.s3_upload.outputs.report_json_url }}
diff --git a/.github/workflows/reusable-pantheon-vrt.yml b/.github/workflows/reusable-pantheon-vrt.yml
index d511281..2cc1a31 100644
--- a/.github/workflows/reusable-pantheon-vrt.yml
+++ b/.github/workflows/reusable-pantheon-vrt.yml
@@ -26,22 +26,9 @@ on:
         type: string
         default: ''
     secrets:
-      PANTHEON_MACHINE_TOKEN:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
-      AWS_ACCESS_KEY_ID:
-        required: true
-      AWS_SECRET_ACCESS_KEY:
-        required: true
-      AWS_S3_BUCKET:
-        required: true
-      AWS_S3_REGION:
-        required: false
-      CLICKUP_API_TOKEN:
-        required: false
-      CLICKUP_TEAM_ID:
-        required: false
-      SLACK_BOT_TOKEN:
-        required: false
+        description: '1Password service account token — loads all CI secrets from s360-cicd vault'
 
 defaults:
   run:
@@ -146,10 +133,31 @@ jobs:
       if: steps.vrt_check.outputs.enabled == 'true'
       uses: actions/checkout@v6
 
+    - name: Configure 1Password
+      if: steps.vrt_check.outputs.enabled == 'true'
+      uses: 1password/load-secrets-action/configure@v2
+      with:
+        service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+    - name: Load secrets
+      if: steps.vrt_check.outputs.enabled == 'true'
+      uses: 1password/load-secrets-action@v2
+      with:
+        export-env: true
+      env:
+        PANTHEON_MACHINE_TOKEN: op://s360-cicd/pantheon/machine-token
+        AWS_ACCESS_KEY_ID: op://s360-cicd/aws-ci/access-key-id
+        AWS_SECRET_ACCESS_KEY: op://s360-cicd/aws-ci/secret-access-key
+        AWS_S3_BUCKET: op://s360-cicd/aws-ci/s3-bucket
+        AWS_S3_REGION: op://s360-cicd/aws-ci/s3-region
+        CLICKUP_API_TOKEN: op://s360-cicd/clickup/api-token
+        CLICKUP_TEAM_ID: op://s360-cicd/clickup/team-id
+        SLACK_BOT_TOKEN: op://s360-cicd/slack/bot-token
+
     - name: Install Terminus
       if: steps.vrt_check.outputs.enabled == 'true'
       env:
-        TERMINUS_MACHINE_TOKEN: ${{ secrets.PANTHEON_MACHINE_TOKEN }}
+        TERMINUS_MACHINE_TOKEN: ${{ env.PANTHEON_MACHINE_TOKEN }}
       run: |
         TERMINUS_VERSION=$(curl -s https://api.github.com/repos/pantheon-systems/terminus/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
         curl -fsSL "https://github.com/pantheon-systems/terminus/releases/download/${TERMINUS_VERSION}/terminus.phar" \
@@ -190,8 +198,8 @@ jobs:
       id: s3_urls
       if: steps.vrt_check.outputs.enabled == 'true'
       env:
-        AWS_S3_BUCKET:       ${{ secrets.AWS_S3_BUCKET }}
-        AWS_S3_REGION_INPUT: ${{ secrets.AWS_S3_REGION }}
+        AWS_S3_BUCKET:       ${{ env.AWS_S3_BUCKET }}
+        AWS_S3_REGION_INPUT: ${{ env.AWS_S3_REGION }}
         PANTHEON_SITE:       ${{ inputs.pantheon_site }}
       run: |
         REGION="${AWS_S3_REGION_INPUT:-us-east-1}"
@@ -725,10 +733,10 @@ jobs:
       id: s3_upload
       if: steps.vrt_check.outputs.enabled == 'true' && steps.run_vrt.conclusion == 'success'
       env:
-        AWS_ACCESS_KEY_ID:     ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        AWS_S3_BUCKET:         ${{ secrets.AWS_S3_BUCKET }}
-        AWS_S3_REGION_INPUT:   ${{ secrets.AWS_S3_REGION }}
+        AWS_ACCESS_KEY_ID:     ${{ env.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
+        AWS_S3_BUCKET:         ${{ env.AWS_S3_BUCKET }}
+        AWS_S3_REGION_INPUT:   ${{ env.AWS_S3_REGION }}
         PANTHEON_SITE:         ${{ inputs.pantheon_site }}
       run: |
         AWS_DEFAULT_REGION="${AWS_S3_REGION_INPUT:-us-east-1}"
@@ -813,8 +821,8 @@ jobs:
         steps.vrt_check.outputs.clickup_task_id != ''
       continue-on-error: true
       env:
-        CLICKUP_API_TOKEN: ${{ secrets.CLICKUP_API_TOKEN }}
-        CLICKUP_TEAM_ID:   ${{ secrets.CLICKUP_TEAM_ID }}
+        CLICKUP_API_TOKEN: ${{ env.CLICKUP_API_TOKEN }}
+        CLICKUP_TEAM_ID:   ${{ env.CLICKUP_TEAM_ID }}
         TASK_ID:           ${{ steps.vrt_check.outputs.clickup_task_id }}
         REPORT_URL:        ${{ steps.s3_upload.outputs.report_url }}
         REPORT_JSON_URL:   ${{ steps.s3_upload.outputs.report_json_url }}
@@ -891,7 +899,7 @@ jobs:
         steps.run_vrt.conclusion == 'success' &&
         inputs.slack_channel != ''
       env:
-        SLACK_BOT_TOKEN:  ${{ secrets.SLACK_BOT_TOKEN }}
+        SLACK_BOT_TOKEN:  ${{ env.SLACK_BOT_TOKEN }}
         SLACK_CHANNEL:    ${{ inputs.slack_channel }}
         REPORT_URL:       ${{ steps.s3_upload.outputs.report_url }}
         REPORT_JSON_URL:  ${{ steps.s3_upload.outputs.report_json_url }}
diff --git a/.github/workflows/reusable-semantic-release.yml b/.github/workflows/reusable-semantic-release.yml
index ccaab2e..11ec95b 100644
--- a/.github/workflows/reusable-semantic-release.yml
+++ b/.github/workflows/reusable-semantic-release.yml
@@ -19,8 +19,9 @@ on:
         type: boolean
         default: false
     secrets:
-      CI_GH_TOKEN:
+      OP_SERVICE_ACCOUNT_TOKEN:
         required: true
+        description: '1Password service account token — loads CI_GH_TOKEN from s360-cicd vault'
 
 defaults:
   run:
@@ -41,6 +42,18 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Configure 1Password
+        uses: 1password/load-secrets-action/configure@v2
+        with:
+          service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+
+      - name: Load secrets
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          CI_GH_TOKEN: op://s360-cicd/github/token
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
@@ -201,4 +214,4 @@ jobs:
             npx semantic-release
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.CI_GH_TOKEN }}
\ No newline at end of file
+          GITHUB_TOKEN: ${{ env.CI_GH_TOKEN }}