diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 3f99dfa6..da601ce6 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -45,11 +45,6 @@ jobs:
           echo "Sleeping for $delay seconds..."
           sleep $delay
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
-
       - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
 
       - name: Generate SDK
@@ -74,12 +69,11 @@ jobs:
         if: steps.check.outputs.has_changes == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
         run: |
           git checkout -b automated/open-api
           git add .
           git commit -m "fix(openapi): sync with openapi definition"
-          git push "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" automated/open-api -fu
+          git push origin automated/open-api -fu
 
       - name: Create Pull Request
         if: steps.check.outputs.has_changes == 'true'
@@ -94,7 +88,7 @@ jobs:
               --head automated/open-api \
               --base main \
               --title "Sync with OpenAPI definition" \
-              --body "## 🔄 OpenAPI Sync
+              --body "## OpenAPI Sync
 
           The OpenAPI definition in the API has been updated. This PR automatically:
           - Downloads the latest OpenAPI specification
@@ -105,7 +99,7 @@ jobs:
           ### What's Changed
           See the file changes below for specific updates to the API types, strict types, and methods.
 
-          ⚠️ **Please review carefully for any breaking changes in the API.**" \
+          **Please review carefully for any breaking changes in the API.**" \
               --label "dependencies" \
               --label "automated"
           else
@@ -113,7 +107,7 @@ jobs:
           fi
 
       - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@da519693b701861bc0f9690a30f50af1a1dcd49c # main
-        if: always()
+        if: steps.check.outputs.has_changes == 'true' && always()
 
   validate:
     name: Validate generated SDK
@@ -125,12 +119,9 @@ jobs:
     outputs:
       has_changes: ${{ steps.check.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          ref: automated/open-api
-
       - uses: SocketDev/socket-registry/.github/actions/setup-and-install@da519693b701861bc0f9690a30f50af1a1dcd49c # main
+        with:
+          checkout-ref: automated/open-api
 
       - name: Build SDK
         run: pnpm run build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14c5ee12..98614da8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [3.5.1](https://github.com/SocketDev/socket-sdk-js/releases/tag/v3.5.1) - 2026-04-04
+
+### Changed
+
+- Updated `@socketsecurity/lib` to v5.12.0
+- Added `minimumReleaseAgeExclude` for Socket-owned packages in pnpm-workspace.yaml
+
+### Fixed
+
+- Fixed generate SDK workflow GPG commit signing and push authentication
+
 ## [3.5.0](https://github.com/SocketDev/socket-sdk-js/releases/tag/v3.5.0) - 2026-04-03
 
 ### Added
diff --git a/package.json b/package.json
index 0442a885..3ee89bb3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/sdk",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "description": "SDK for the Socket API client",
   "homepage": "https://github.com/SocketDev/socket-sdk-js",
   "license": "MIT",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@socketregistry/packageurl-js": "1.4.1",
-    "@socketsecurity/lib": "5.11.4",
+    "@socketsecurity/lib": "5.12.0",
     "form-data": "4.0.5"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ba319393..50338d2d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -15,8 +15,8 @@ importers:
         specifier: 1.4.1
         version: 1.4.1
       '@socketsecurity/lib':
-        specifier: 5.11.4
-        version: 5.11.4(typescript@5.9.3)
+        specifier: 5.12.0
+        version: 5.12.0(typescript@5.9.3)
       form-data:
         specifier: 4.0.5
         version: 4.0.5
@@ -1026,8 +1026,8 @@ packages:
     resolution: {integrity: sha512-t/UrOd1DMYXcGuKo2v07WMbuHCMlKBKOriTHu4cn9OIxfj1qWKoF/kpOswGHOWkG5zwj2Ke/2+qLiDugmx5z+A==}
     engines: {node: '>=18.20.4', pnpm: '>=10.25.0'}
 
-  '@socketsecurity/lib@5.11.4':
-    resolution: {integrity: sha512-3/stIFexg45DNhGvpw/U49UFuHYe0ZLS45scuYw83HfWrHmL7h9Mi4m27C3/ihAF6O9uOJSKBsWBIHlTM8Wikg==}
+  '@socketsecurity/lib@5.12.0':
+    resolution: {integrity: sha512-OLTHvVBRpfwpVHzlDFPl5kxJ6xifOVqbPLc8AqFh+tujzeiIG87yvTijxRnA5G4dqaffujkK7jkxM71UQkyK0w==}
     engines: {node: '>=22', pnpm: '>=10.25.0'}
     peerDependencies:
       typescript: '>=5.0.0'
@@ -2641,7 +2641,7 @@ snapshots:
     dependencies:
       picomatch: 4.0.3
 
-  '@socketsecurity/lib@5.11.4(typescript@5.9.3)':
+  '@socketsecurity/lib@5.12.0(typescript@5.9.3)':
     optionalDependencies:
       typescript: 5.9.3
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f8c05760..e177bc7e 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,2 +1,7 @@
 # Wait 7 days (10080 minutes) before installing newly published packages.
 minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@socketaddon/*'
+  - '@socketbin/*'
+  - '@socketregistry/*'
+  - '@socketsecurity/*'