diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a0bc7e91..c2c48223 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -25,7 +25,15 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  security:
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: WireCatLabs/cli-core/.github/workflows/release-checks.yml@1183bfb970330989ad8acec917b14b7e6187de15
+
   deploy:
+    needs: security
     runs-on: ubuntu-latest
     env:
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
diff --git a/tests/search-playground.spec.ts b/tests/search-playground.spec.ts
index becbc962..3607c2a0 100644
--- a/tests/search-playground.spec.ts
+++ b/tests/search-playground.spec.ts
@@ -81,7 +81,11 @@ for (const theme of ["light", "dark"]) {
     await page.emulateMedia({ colorScheme: "light" })
     await page.goto("/en/docs/search-playground")
     await page.locator("#search-playground").waitFor()
-    if (theme === "dark") await page.locator(".theme-toggle:visible").first().click()
+    if (theme === "dark") {
+      const toggle = page.locator(".theme-toggle:visible").first()
+      await expect(toggle).toHaveAttribute("aria-label", "Switch to dark theme")
+      await toggle.click()
+    }
     await expect(page.locator("html")).toHaveClass(theme === "dark" ? /dark/ : /light/)
     const results = await new AxeBuilder({ page })
       .include("#search-playground")