diff --git a/.github/workflows/regen.yml b/.github/workflows/regen.yml
index 1a783ef..b5a614d 100644
--- a/.github/workflows/regen.yml
+++ b/.github/workflows/regen.yml
@@ -16,17 +16,26 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Discover latest archive version
+      - uses: bufbuild/buf-action@v1
+        with:
+          setup_only: true
+
+      - name: Discover latest schema commit
         id: latest
         run: |
-          current=$(grep -E 'readonly BUF_PY_VERSION="' scripts/regen.sh \
+          current=$(grep -E 'readonly BUF_SCHEMA_COMMIT="' scripts/regen.sh \
             | sed -E 's/.*="([^"]+)".*/\1/')
           echo "current=$current" >> "$GITHUB_OUTPUT"
-          # Buf does not expose a public version-list endpoint; we resolve
-          # `main` to a pinned ref by introspecting the redirect target.
-          latest=$(curl -sI \
-            "https://buf.build/gen/archive/openstatus/api/protocolbuffers/python/main.zip" \
-            | grep -i '^location:' | sed -E 's/.*\/([^/]+)\.zip.*/\1/' | tr -d '\r')
+          # Version string looks like 35.1.0.1.20260727085848+65e5c3248a1e;
+          # the commit suffix is the only coordinate shared across languages.
+          version=$(buf registry sdk version \
+            --module=buf.build/openstatus/api \
+            --plugin=buf.build/protocolbuffers/python)
+          latest="${version##*+}"
+          if [[ -z "$latest" || "$latest" == "$version" ]]; then
+            echo "::error::schema version discovery returned empty"
+            exit 1
+          fi
           echo "latest=$latest" >> "$GITHUB_OUTPUT"
 
       - name: No-op when already up to date
@@ -36,18 +45,28 @@ jobs:
       - name: Bump pin and regenerate
         if: steps.latest.outputs.latest != steps.latest.outputs.current
         run: |
-          sed -i -E "s/(readonly BUF_PY_VERSION=)\"[^\"]+\"/\1\"${{ steps.latest.outputs.latest }}\"/" \
+          sed -i -E "s/(readonly BUF_SCHEMA_COMMIT=)\"[^\"]+\"/\1\"${{ steps.latest.outputs.latest }}\"/" \
             scripts/regen.sh
           bash scripts/regen.sh
 
+      - name: Bump patch version
+        if: steps.latest.outputs.latest != steps.latest.outputs.current
+        run: |
+          cur=$(grep -oP '^version = "\K[^"]+' pyproject.toml)
+          IFS=. read -r maj min pat <<< "$cur"
+          next="$maj.$min.$((pat + 1))"
+          sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"$next\"/" pyproject.toml
+          echo "bumped $cur -> $next"
+
       - name: Open PR
         if: steps.latest.outputs.latest != steps.latest.outputs.current
         uses: peter-evans/create-pull-request@v6
         with:
+          token: ${{ secrets.SDK_BOT_TOKEN || github.token }}
           branch: regen/${{ steps.latest.outputs.latest }}
           commit-message: "chore: bump buf schema to ${{ steps.latest.outputs.latest }}"
           title: "chore: bump buf schema to ${{ steps.latest.outputs.latest }}"
           body: |
-            Automated bump of the pinned `protocolbuffers/python` archive
-            version from `${{ steps.latest.outputs.current }}` to
+            Automated regeneration from `buf.build/openstatus/api` schema
+            commit `${{ steps.latest.outputs.current }}` to
             `${{ steps.latest.outputs.latest }}`.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dc1adf1..ef1cf92 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   publish:
+    if: github.repository == 'openstatusHQ/sdk-python'
     name: build and publish to PyPI
     runs-on: ubuntu-latest
     environment:
diff --git a/scripts/regen.sh b/scripts/regen.sh
index ba0b6c9..2eaae73 100755
--- a/scripts/regen.sh
+++ b/scripts/regen.sh
@@ -1,9 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Pinned Buf-generated archives for buf.build/openstatus/api.
-# To upgrade: change this line, run `bash scripts/regen.sh`, commit the result.
-readonly BUF_PY_VERSION="v35.0-7d7b7047611f.1"
+# Schema commit of buf.build/openstatus/api that this tree was generated from.
+# Change-detection marker only — the archive itself is fetched by the `main`
+# label, since the archive URL uses a plugin-version coordinate that cannot be
+# reconstructed from the commit alone.
+readonly BUF_SCHEMA_COMMIT="65e5c3248a1e"
 
 # Transitive deps. Buf does not expose pinned versions for these from the
 # openstatus/api module, so we track main. The PHP plan ships empty initOnce()
@@ -31,12 +33,12 @@ fetch() {
     unzip -q "${TMP}/${name}-${plugin}.zip" -d "${TMP}/${name}-${plugin}"
 }
 
-fetch "openstatus/api"        python "${BUF_PY_VERSION}" openstatus
-fetch "openstatus/api"        pyi    "${BUF_PY_VERSION}" openstatus
-fetch "${BUF_VALIDATE_REF}"   python main                bufvalidate
-fetch "${BUF_VALIDATE_REF}"   pyi    main                bufvalidate
-fetch "${GNOSTIC_REF}"        python main                gnostic
-fetch "${GNOSTIC_REF}"        pyi    main                gnostic
+fetch "openstatus/api"        python main openstatus
+fetch "openstatus/api"        pyi    main openstatus
+fetch "${BUF_VALIDATE_REF}"   python main bufvalidate
+fetch "${BUF_VALIDATE_REF}"   pyi    main bufvalidate
+fetch "${GNOSTIC_REF}"        python main gnostic
+fetch "${GNOSTIC_REF}"        pyi    main gnostic
 
 # Merge a top-level package from a buf archive into $DEST.
 #   - archive layout: <archive>/<plugin-prefix>_<lang>/<pkg-root>/...
@@ -67,7 +69,7 @@ merge gnostic-pyi        gnostic
 # `openstatus` package is not polluted and so the buf/gnostic vendored copies
 # do not collide with any user-installed packages of the same name.
 find "$DEST" -type f \( -name '*.py' -o -name '*.pyi' \) -print0 \
-    | xargs -0 sed -i '' \
+    | xargs -0 sed -i \
         -e 's|^from openstatus\.|from openstatus._gen.openstatus.|g' \
         -e 's|^from buf\.|from openstatus._gen.buf.|g' \
         -e 's|^from gnostic\.|from openstatus._gen.gnostic.|g' \
@@ -78,8 +80,8 @@ find "$DEST" -type f \( -name '*.py' -o -name '*.pyi' \) -print0 \
 # Generated trees ship no __init__.py — create empty shims so packages import.
 find "$DEST" -type d -exec sh -c 'touch "$0/__init__.py"' {} \;
 
-echo "${BUF_PY_VERSION}" > "$DEST/VERSION"
+echo "${BUF_SCHEMA_COMMIT}" > "$DEST/VERSION"
 
 echo
 echo "Done. Generated tree at $DEST"
-echo "Pinned openstatus version recorded at $DEST/VERSION"
+echo "Schema commit recorded at $DEST/VERSION"