diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 274ae76..73206b1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,4 @@
-# managed-by: talieisin-org-bootstrap v2
+# managed-by: talieisin-org-bootstrap v4
 version: 2
 updates:
   - package-ecosystem: "github-actions"
diff --git a/.github/workflows/dependabot-agent.yml b/.github/workflows/dependabot-agent.yml
index fdd0913..dd6c21c 100644
--- a/.github/workflows/dependabot-agent.yml
+++ b/.github/workflows/dependabot-agent.yml
@@ -1,10 +1,12 @@
-# managed-by: talieisin-org-bootstrap v2
+# managed-by: talieisin-org-bootstrap v4
 # Fires when the org dispatcher labels a major Dependabot PR `ai-upgrade`.
 # All logic lives in Talieisin/.github — see its docs/ai-automation.md.
 name: AI upgrade
 on:
   pull_request:
     types: [labeled]
+  pull_request_review:
+    types: [submitted]
 
 permissions:
   contents: read
@@ -15,15 +17,27 @@ permissions:
 
 jobs:
   upgrade:
-    if: github.event.label.name == 'ai-upgrade'
+    if: github.event_name == 'pull_request' && github.event.label.name == 'ai-upgrade'
     uses: Talieisin/.github/.github/workflows/dependabot-upgrade.yml@main
     with:
       setup: none
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
       COPILOT_REVIEW_PAT: ${{ secrets.COPILOT_REVIEW_PAT }}
+      TALIEISIN_CODEX_APP_ID: ${{ secrets.TALIEISIN_CODEX_APP_ID }}
+      TALIEISIN_CODEX_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_CODEX_APP_PRIVATE_KEY }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       TALIEISIN_AUTOMATION_APP_ID: ${{ secrets.TALIEISIN_AUTOMATION_APP_ID }}
       TALIEISIN_AUTOMATION_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_AUTOMATION_APP_PRIVATE_KEY }}
       TALIEISIN_TRIGGER_APP_ID: ${{ secrets.TALIEISIN_TRIGGER_APP_ID }}
       TALIEISIN_TRIGGER_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_TRIGGER_APP_PRIVATE_KEY }}
+
+  copilot-response:
+    if: github.event_name == 'pull_request_review' && startsWith(github.event.review.user.login, 'copilot')
+    uses: Talieisin/.github/.github/workflows/copilot-response.yml@main
+    with:
+      setup: none
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      TALIEISIN_AUTOMATION_APP_ID: ${{ secrets.TALIEISIN_AUTOMATION_APP_ID }}
+      TALIEISIN_AUTOMATION_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_AUTOMATION_APP_PRIVATE_KEY }}