diff --git a/.github/workflows/ts-core-tests.yml b/.github/workflows/ts-core-tests.yml
index 8815333..e3e6e8d 100644
--- a/.github/workflows/ts-core-tests.yml
+++ b/.github/workflows/ts-core-tests.yml
@@ -3,10 +3,10 @@ name: ts_core tests
 on:
   push:
     branches: [main]
-    paths: ['ts_core/**']
+    paths: ['ts_core/**', 'ts_config/**']
   pull_request:
     branches: [main]
-    paths: ['ts_core/**']
+    paths: ['ts_core/**', 'ts_config/**']
 
 jobs:
   test:
@@ -26,6 +26,14 @@ jobs:
         with:
           node-version: "24.21.0"
 
+      # The preset is a `link:../ts_config` dependency. pnpm links the
+      # directory but installs nothing inside it, and a flat config imports
+      # its plugins from the preset's own node_modules -- so without this
+      # step the lint dies on "Cannot find package '@eslint/js'".
+      - name: Install the shared lint preset's dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: ts_config
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/.github/workflows/web-ui-tests.yml b/.github/workflows/web-ui-tests.yml
index d2017c3..ad8141f 100644
--- a/.github/workflows/web-ui-tests.yml
+++ b/.github/workflows/web-ui-tests.yml
@@ -3,10 +3,10 @@ name: web_ui tests
 on:
   push:
     branches: [main]
-    paths: ['web_ui/**']
+    paths: ['web_ui/**', 'ts_config/**']
   pull_request:
     branches: [main]
-    paths: ['web_ui/**']
+    paths: ['web_ui/**', 'ts_config/**']
 
 jobs:
   test:
@@ -26,6 +26,14 @@ jobs:
         with:
           node-version: "24.21.0"
 
+      # The preset is a `link:../ts_config` dependency. pnpm links the
+      # directory but installs nothing inside it, and a flat config imports
+      # its plugins from the preset's own node_modules -- so without this
+      # step the lint dies on "Cannot find package '@eslint/js'".
+      - name: Install the shared lint preset's dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: ts_config
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
diff --git a/crdt-sync/requirements.txt b/crdt-sync/requirements.txt
index aeefd6c..b1e4b97 100644
--- a/crdt-sync/requirements.txt
+++ b/crdt-sync/requirements.txt
@@ -8,5 +8,5 @@ pylint==4.0.8
 pytest==9.1.1
 pytest-cov==7.1.0
 requests==2.34.2
-ruff==0.16.7
+ruff==0.16.8
 types-requests==2.33.0.20260906
diff --git a/crdt_sync_flutter/pubspec.yaml b/crdt_sync_flutter/pubspec.yaml
index d6f1f90..759cd5b 100644
--- a/crdt_sync_flutter/pubspec.yaml
+++ b/crdt_sync_flutter/pubspec.yaml
@@ -18,7 +18,7 @@ dependencies:
   crypto: 3.0.7
   flutter:
     sdk: flutter
-  flutter_secure_storage: 11.1.1
+  flutter_secure_storage: 11.2.0
   # A real dependency, not a dev one: lib/testing/ ships the keystore fake so
   # consuming apps can test their own sync wiring without rebuilding it.
   flutter_test:
diff --git a/freedays/requirements.txt b/freedays/requirements.txt
index 66bbda4..3fb1694 100644
--- a/freedays/requirements.txt
+++ b/freedays/requirements.txt
@@ -7,4 +7,4 @@ pre-commit==4.6.2
 pylint==4.0.8
 pytest==9.1.1
 pytest-cov==7.1.0
-ruff==0.16.7
+ruff==0.16.8
diff --git a/gatelock/requirements.txt b/gatelock/requirements.txt
index 66bbda4..3fb1694 100644
--- a/gatelock/requirements.txt
+++ b/gatelock/requirements.txt
@@ -7,4 +7,4 @@ pre-commit==4.6.2
 pylint==4.0.8
 pytest==9.1.1
 pytest-cov==7.1.0
-ruff==0.16.7
+ruff==0.16.8
diff --git a/music_theory/requirements.txt b/music_theory/requirements.txt
index a0d6f35..480946e 100644
--- a/music_theory/requirements.txt
+++ b/music_theory/requirements.txt
@@ -8,4 +8,4 @@ pre-commit==4.6.2
 pylint==4.0.8
 pytest==9.1.1
 pytest-cov==7.1.0
-ruff==0.16.7
+ruff==0.16.8