diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 7c0274a445..48b19a8566 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -64,7 +64,6 @@ For the full CI gambit, the following repository configuration must be set:
 ![image](https://github.com/tgstation/tgstation-server/assets/8171642/ab17fa74-364f-4e66-b7c4-b9bb24c6a599)
 - Label `CI Cleared`: To allow PRs from forks to run CI with secrets after approval.
 - Integration [CodeCov](https://github.com/apps/codecov): Enables CodeCov status checks.
-- Secret `CI_STATUSES_TOKEN`: A GitHub token with read access to the repository's contents/actions and write access to the repository's checks/security events. Used to create CI completion statuses.
 - Secret `CODECOV_TOKEN`: A CodeCov repo token to work around https://github.com/codecov/codecov-action/issues/837.
 - Secret `LIVE_TESTS_TOKEN`: A GitHub token with read access to the repository and write access to https://github.com/Cyberboss/common_core (TODO: Make the target repository here configurable). Despite it's name, it may be used across the entire test suite.
 - Secret `TGS_TEST_DISCORD_TOKEN`: See above note about test environment variables.
diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml
index c8612242b9..49d1a5bc69 100644
--- a/.github/workflows/ci-pipeline.yml
+++ b/.github/workflows/ci-pipeline.yml
@@ -85,6 +85,10 @@ jobs:
     name: Code Scanning
     needs: start-ci-run-gate
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+    if: (!(cancelled() || failure()) && needs.start-ci-run-gate.result == 'success')
     steps:
     - name: Setup dotnet
       uses: actions/setup-dotnet@v4
@@ -92,14 +96,20 @@ jobs:
         dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x'
         dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }}
 
-    - name: Checkout
+    - name: Checkout (Branch)
       uses: actions/checkout@v4
+      if: github.event_name == 'push' || github.event_name == 'schedule'
+
+    - name: Checkout (PR Merge)
+      uses: actions/checkout@v4
+      if: github.event_name != 'push' && github.event_name != 'schedule'
+      with:
+        ref: "refs/pull/${{ github.event.number }}/merge"
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
         languages: csharp
-        token: ${{ secrets.CI_STATUSES_TOKEN }}
 
     - name: Build
       run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true
@@ -108,8 +118,6 @@ jobs:
       uses: github/codeql-action/analyze@v3
       with:
         category: "/language:csharp"
-        token: ${{ secrets.CI_STATUSES_TOKEN }}
-
 
   dmapi-build:
     name: Build DMAPI
@@ -610,7 +618,7 @@ jobs:
         path: C:/tgs_api.json
 
     - name: Package Server Service
-      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
+      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }}
       run: |
         cd src/Tgstation.Server.Host.Service
         dotnet publish -c ${{ matrix.configuration }} -o ../../artifacts/Service
@@ -622,14 +630,14 @@ jobs:
         build/RemoveUnsupportedServiceRuntimes.ps1 artifacts/Service
 
     - name: Store Server Service
-      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
+      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }}
       uses: actions/upload-artifact@v4
       with:
         name: ServerService
         path: artifacts/Service/
 
     - name: Install Code Signing Certificate
-      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
+      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }}
       shell: powershell
       run: |
         $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}")
@@ -639,7 +647,7 @@ jobs:
         rm tg_codesigning.pfx
 
     - name: Test Sign Service .exe
-      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' }}
+      if: ${{ matrix.configuration == 'Release' && matrix.watchdog-type == 'Basic' && matrix.database-type == 'PostgresSql' }}
       shell: powershell
       run: Set-AuthenticodeSignature artifacts/Service/Tgstation.Server.Host.Service.exe -Certificate (Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "${{ vars.CODE_SIGNING_THUMBPRINT }}" }) -TimestampServer "http://timestamp.digicert.com"
 
@@ -1373,12 +1381,15 @@ jobs:
     name: CI Completion Gate
     needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, code-scanning ]
     runs-on: ubuntu-latest
-    if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success')
+    permissions:
+      checks: write
+      contents: read
+    if: (!(cancelled() || failure()) && needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success' && needs.code-scanning.result == 'success')
     steps:
     - name: Create Completion Check
       uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23
       with:
-        token: ${{ secrets.CI_STATUSES_TOKEN }}
+        token: ${{ secrets.GITHUB_TOKEN }}
         name: CI Completion
         conclusion: success
         output: |
diff --git a/.github/workflows/stable-merge.yml b/.github/workflows/stable-merge.yml
index 8b77f4d7d3..9135dc5f7a 100644
--- a/.github/workflows/stable-merge.yml
+++ b/.github/workflows/stable-merge.yml
@@ -12,7 +12,9 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
 
     - name: Merge master into dev
       uses: robotology/gh-action-nightly-merge@22f5e45d028f22837d617fa07512925457eec184 #v1.3.3