diff --git a/template/.github/workflows/ci.yml.jinja b/template/.github/workflows/ci.yml.jinja
index c9ec18a..1a3b7fe 100644
--- a/template/.github/workflows/ci.yml.jinja
+++ b/template/.github/workflows/ci.yml.jinja
@@ -12,7 +12,7 @@ jobs:
       CS_ACCESS_TOKEN: ${{ "{{" }} secrets.CS_ACCESS_TOKEN {{ "}}" }}
       CODESCENE_CLI_SHA256: ${{ "{{" }} vars.CODESCENE_CLI_SHA256 {{ "}}" }}
       {% if use_rust %}
-      WHITAKER_INSTALLER_REV: f768c2e53c47df13658af1168a67851d388750bf
+      WHITAKER_INSTALLER_VERSION: '0.2.5'
       CARGO_TERM_COLOR: always
       BUILD_PROFILE: debug
       {% endif %}
@@ -50,10 +50,8 @@ jobs:
         env:
           RUSTFLAGS: ""
         run: |
-          cargo install --locked \
-            --git https://github.com/leynos/whitaker \
-            --rev "${WHITAKER_INSTALLER_REV}" \
-            whitaker-installer
+          cargo binstall --no-confirm --locked \
+            whitaker-installer@"${WHITAKER_INSTALLER_VERSION}"
           whitaker-installer --cranelift
           cargo install --locked cargo-audit
 
@@ -82,7 +80,7 @@ jobs:
         run: make audit
 
       - name: Test and Measure Coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@455d9ed03477c0026da96c2541ca26569a74acac
+        uses: leynos/shared-actions/.github/actions/generate-coverage@296dc4aa07acf3a7f60a54fb6bccb5672a597479
         with:
           output-path: coverage.xml
           format: cobertura
@@ -94,10 +92,14 @@ jobs:
       - name: Install CodeScene Coverage CLI
         if: env.CS_ACCESS_TOKEN != ''
         run: |
-          curl -fsSL https://downloads.codescene.io/enterprise/cli/install-cs-coverage-tool.sh | bash -s -- -y
+          curl -fsSL --output install-cs-coverage-tool.sh \
+            https://downloads.codescene.io/enterprise/cli/install-cs-coverage-tool.sh
           if [ -n "${CODESCENE_CLI_SHA256:-}" ]; then
             echo "${CODESCENE_CLI_SHA256}  install-cs-coverage-tool.sh" | sha256sum -c -
+          else
+            echo "::notice::CODESCENE_CLI_SHA256 is not set; skipping installer checksum verification"
           fi
+          bash install-cs-coverage-tool.sh -y
 
       - name: Upload coverage to CodeScene
         if: env.CS_ACCESS_TOKEN != ''
diff --git a/template/Makefile.jinja b/template/Makefile.jinja
index e73647f..8f1639f 100644
--- a/template/Makefile.jinja
+++ b/template/Makefile.jinja
@@ -32,7 +32,7 @@ CLIPPY_FLAGS ?= $(CARGO_FLAGS) -- $(RUST_FLAGS)
 TEST_FLAGS ?= $(CARGO_FLAGS)
 TEST_CMD := $(if $(CARGO_AVAILABLE),$(if $(shell $(CARGO) nextest --version 2>/dev/null),nextest run,test),)
 WHITAKER_CARGO_FLAGS ?= --all-targets --all-features
-WHITAKER_INSTALLER_REV ?= f768c2e53c47df13658af1168a67851d388750bf
+WHITAKER_INSTALLER_VERSION ?= 0.2.5
 WHITAKER ?= $(or $(shell command -v whitaker 2>/dev/null),$(wildcard $(USER_WHITAKER)),whitaker)
 {% endif %}
 
@@ -108,9 +108,7 @@ whitaker: ## Install Whitaker when the generated Rust lint target needs it
 	    exit 1; \
 	  }; \
 	  $(CARGO) install --locked \
-	    --git https://github.com/leynos/whitaker \
-	    --rev "$(WHITAKER_INSTALLER_REV)" \
-	    whitaker-installer; \
+	    whitaker-installer --version "$(WHITAKER_INSTALLER_VERSION)"; \
 	  PATH="$(HOME)/.cargo/bin:$$PATH" whitaker-installer --cranelift; \
 	fi
 
diff --git a/tests/helpers/ci_contracts.py b/tests/helpers/ci_contracts.py
index 2226dec..3511bb7 100644
--- a/tests/helpers/ci_contracts.py
+++ b/tests/helpers/ci_contracts.py
@@ -71,7 +71,7 @@ def assert_ci_coverage_action_contract(
     assert (
         coverage_step.get("uses")
         == "leynos/shared-actions/.github/actions/generate-coverage"
-        "@455d9ed03477c0026da96c2541ca26569a74acac"
+        "@296dc4aa07acf3a7f60a54fb6bccb5672a597479"
     ), "expected CI to use the pinned shared coverage action"
     coverage_inputs = require_mapping(coverage_step, "with", "coverage step")
     assert coverage_inputs.get("output-path") == "coverage.xml", (
diff --git a/tests/test_helpers.py b/tests/test_helpers.py
index b549b42..e9cca5c 100644
--- a/tests/test_helpers.py
+++ b/tests/test_helpers.py
@@ -501,7 +501,7 @@ def _ci_workflow(*, persist_credentials: str, coverage_inputs: str) -> str:
         with:
           persist-credentials: {persist_credentials}
       - name: Test and Measure Coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@455d9ed03477c0026da96c2541ca26569a74acac
+        uses: leynos/shared-actions/.github/actions/generate-coverage@296dc4aa07acf3a7f60a54fb6bccb5672a597479
         with:
           output-path: coverage.xml
           format: cobertura