diff --git a/.github/dependency-policy.json b/.github/dependency-policy.json
deleted file mode 100644
index f3023cf..0000000
--- a/.github/dependency-policy.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "version": 1,
-  "mode": "auto",
-  "ci_workflow": "ci.yml",
-  "required_checks": [
-    "Test"
-  ],
-  "integration_job": "ci",
-  "dispatch_workflow": "ci.yml",
-  "max_group_size": 10,
-  "managed_dependencies": [
-    "aviorstudio/gdam-actions/*",
-    "nicodes/komizo-actions/*",
-    "nicodes/komizo/*",
-    "nicodes/tools/*"
-  ],
-  "sensitive_dependencies": [
-    "*clerk*",
-    "*pocketbase*",
-    "*crypto*",
-    "*jsonwebtoken*",
-    "*jose*",
-    "*oauth*",
-    "*openid*",
-    "*passport*",
-    "*bcrypt*",
-    "*argon2*",
-    "@noble/*",
-    "*prisma*",
-    "*drizzle*",
-    "*migrate*",
-    "modernc.org/sqlite",
-    "github.com/jackc/pgx/*",
-    "github.com/go-sql-driver/mysql",
-    "go.mongodb.org/mongo-driver/*"
-  ]
-}
diff --git a/.github/dependency-policy.toml b/.github/dependency-policy.toml
new file mode 100644
index 0000000..1478995
--- /dev/null
+++ b/.github/dependency-policy.toml
@@ -0,0 +1,9 @@
+version = 1
+mode = "auto"
+ci_workflow = "ci.yml"
+required_checks = ["Test"]
+integration_job = "ci"
+dispatch_workflow = "ci.yml"
+max_group_size = 10
+managed_dependencies = ["aviorstudio/gdam-actions/*", "nicodes/komizo-actions/*", "nicodes/komizo/*", "nicodes/tools/*"]
+sensitive_dependencies = ["*clerk*", "*pocketbase*", "*crypto*", "*jsonwebtoken*", "*jose*", "*oauth*", "*openid*", "*passport*", "*bcrypt*", "*argon2*", "@noble/*", "*prisma*", "*drizzle*", "*migrate*", "modernc.org/sqlite", "github.com/jackc/pgx/*", "github.com/go-sql-driver/mysql", "go.mongodb.org/mongo-driver/*"]
diff --git a/.github/readme-source.json b/.github/readme-source.json
deleted file mode 100644
index 178bf3f..0000000
--- a/.github/readme-source.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "version": 1,
-  "sha256": "1e665422df7c46c45c7012d5edea1d202e481ad75fed77f2411b2498e1998bc3",
-  "history": {
-    "forbidden_commits": [
-      "0eb77f25b1b2c0df30fb7a80abb435bf5bd65724"
-    ]
-  }
-}
diff --git a/.github/readme-source.toml b/.github/readme-source.toml
new file mode 100644
index 0000000..a0fd250
--- /dev/null
+++ b/.github/readme-source.toml
@@ -0,0 +1,5 @@
+version = 1
+sha256 = "1e665422df7c46c45c7012d5edea1d202e481ad75fed77f2411b2498e1998bc3"
+
+[history]
+forbidden_commits = ["0eb77f25b1b2c0df30fb7a80abb435bf5bd65724"]
diff --git a/.github/scripts/check-documentation.py b/.github/scripts/check-documentation.py
index ae3dbd9..e2a7c19 100644
--- a/.github/scripts/check-documentation.py
+++ b/.github/scripts/check-documentation.py
@@ -1,11 +1,11 @@
 #!/usr/bin/env python3
 """Check tracked documentation layout and the reviewed usage README digest."""
 import hashlib
-import json
 import os
 from pathlib import Path, PurePosixPath
 import subprocess
 import sys
+import tomllib
 
 MARKDOWN = {'.md', '.markdown', '.mdown', '.mkd', '.mkdn', '.mdwn', '.mdx', '.rmd', '.qmd'}
 OTHER_DOCS = {'.rst', '.adoc', '.asciidoc'}
@@ -39,10 +39,10 @@ def check(root, include_history=True, history_required=False):
                 body = readme.read_bytes()
                 if not any(line.startswith('# ') for line in body.decode('utf-8').splitlines()):
                     errors.append('root README.md needs a product heading')
-                policy_path = root / '.github/readme-source.json'
+                policy_path = root / '.github/readme-source.toml'
                 if policy_path.is_symlink():
                     raise ValueError('README source policy cannot be a symlink')
-                policy = json.loads(policy_path.read_text())
+                policy = tomllib.loads(policy_path.read_text())
                 if policy.get('version') != 1:
                     raise ValueError('unsupported README source policy')
                 if hashlib.sha256(body).hexdigest() != policy.get('sha256'):
diff --git a/.github/workflows/dependency-policy.yml b/.github/workflows/dependency-policy.yml
index f3c6807..55d5f6b 100644
--- a/.github/workflows/dependency-policy.yml
+++ b/.github/workflows/dependency-policy.yml
@@ -48,7 +48,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
-      uses: nicodes/tools/dependencies@a1c0321f3b4917a7e99eca42e241e46670f6e1e1
+      uses: nicodes/tools/dependencies@39666e8d26d2bd0e1c7e5fee6f289fd0fd3a5202
       with:
         apply: 'true'
         output: ${{ runner.temp }}/dependency-report.json