diff --git a/.github/actions/setup-rust-and-protoc/action.yml b/.github/actions/setup-rust-and-protoc/action.yml
index 287e214802..a4f1141078 100644
--- a/.github/actions/setup-rust-and-protoc/action.yml
+++ b/.github/actions/setup-rust-and-protoc/action.yml
@@ -22,14 +22,7 @@ inputs:
     description: Whether to install Protoc
     required: false
     default: "true"
-  protoc-version:
-    description: Protoc version selector
-    required: false
-    default: "26.1"
-  protoc-repo-token:
-    description: Token used by setup-protoc to avoid API rate limit
-    required: false
-    default: ${{ github.token }}
+
 
 runs:
   using: composite
@@ -45,9 +38,15 @@ runs:
     - name: Install Protoc
       if: ${{ inputs.setup-protoc == 'true' }}
       env:
-        PROTOC_VERSION: ${{ inputs.protoc-version }}
-        PROTOC_REPO_TOKEN: ${{ inputs.protoc-repo-token }}
-      uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
-      with:
-        version: ${{ env.PROTOC_VERSION }}
-        repo-token: ${{ env.PROTOC_REPO_TOKEN }} # Add github token to avoid rate limit see docs https://github.com/arduino/setup-protoc
+        PROTOC_VERSION: "34.1"
+        PROTOC_SHA256: af27ea66cd26938fe48587804ca7d4817457a08350021a1c6e23a27ccc8c6904
+      shell: bash
+      run: |
+        echo "$PATH"
+        set -euo pipefail
+        PROTOC_ARCHIVE="protoc-${PROTOC_VERSION}-linux-x86_64.zip"
+        curl -LO "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/${PROTOC_ARCHIVE}"
+        echo "${PROTOC_SHA256}  ${PROTOC_ARCHIVE}" | sha256sum --check --strict
+        mkdir -p "${HOME}/.local"
+        unzip -o "${PROTOC_ARCHIVE}" -d "${HOME}/.local"
+        protoc --version
diff --git a/.github/workflows/common-testing.yml b/.github/workflows/common-testing.yml
index ab4c4c146c..96a645f1cb 100644
--- a/.github/workflows/common-testing.yml
+++ b/.github/workflows/common-testing.yml
@@ -133,8 +133,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index f3d028c3e8..dd0e851142 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -173,7 +173,7 @@ jobs:
     if: |
       (github.event_name != 'workflow_dispatch' || inputs.build-golden-image) &&
       needs.golden-image-tag.outputs.cache_hit != 'true'
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3ad2e177a5247777349447608ba20f0977a824f # v1.0.7
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code
@@ -269,7 +269,7 @@ jobs:
       !cancelled() &&
       needs.golden-image-latest.result == 'success' &&
       (github.event_name != 'workflow_dispatch' || inputs.build-core-client)
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3ad2e177a5247777349447608ba20f0977a824f # v1.0.7
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code
@@ -306,7 +306,7 @@ jobs:
       !cancelled() &&
       needs.golden-image-latest.result == 'success' &&
       (github.event_name != 'workflow_dispatch' || inputs.build-core-service)
-    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@478ee7de5baeab4fd49edfc42c9b81a56f6cfb03 # v1.0.5
+    uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@f3ad2e177a5247777349447608ba20f0977a824f # v1.0.7
     permissions:
       actions: read # Required to read workflow run information
       contents: read # Required to checkout repository code
diff --git a/.github/workflows/kind-testing.yml b/.github/workflows/kind-testing.yml
index b96ea7a3b9..169c9c8c1a 100644
--- a/.github/workflows/kind-testing.yml
+++ b/.github/workflows/kind-testing.yml
@@ -217,8 +217,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           setup-rust: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup cargo nextest
         if: matrix.cargo-check == false
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 075a90f6e1..a65f21890f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -408,8 +408,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2  # zizmor: ignore[cache-poisoning]
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index c64ccba5a5..1435206c87 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -31,8 +31,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           setup-rust: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # WASM handling
       - name: Install
diff --git a/.github/workflows/pr-preview-deploy.yml b/.github/workflows/pr-preview-deploy.yml
index 210eefb49a..21fa30d11d 100644
--- a/.github/workflows/pr-preview-deploy.yml
+++ b/.github/workflows/pr-preview-deploy.yml
@@ -183,8 +183,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: rustfmt, clippy, llvm-tools-preview, llvm-tools
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # ======================================================================
       # KUBERNETES & HELM SETUP
diff --git a/.github/workflows/rust-lint.yml b/.github/workflows/rust-lint.yml
index 78ad65f093..06ebd47368 100644
--- a/.github/workflows/rust-lint.yml
+++ b/.github/workflows/rust-lint.yml
@@ -38,8 +38,6 @@ jobs:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
           rust-components: rustfmt, clippy
           rust-cache: "false"
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
diff --git a/.github/workflows/wasm-testing.yml b/.github/workflows/wasm-testing.yml
index 468094fa27..da67b1ad85 100644
--- a/.github/workflows/wasm-testing.yml
+++ b/.github/workflows/wasm-testing.yml
@@ -52,8 +52,6 @@ jobs:
         uses: ./.github/actions/setup-rust-and-protoc
         with:
           rust-toolchain: ${{ env.RUST_IMAGE_VERSION }}
-          protoc-version: '26.1'
-          protoc-repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # WASM handling
       - name: Install