diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..ca79ca5b4d5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml
index c731485f782..7d2da0f66eb 100644
--- a/.github/workflows/changelog-check.yml
+++ b/.github/workflows/changelog-check.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4
 
     - name: git diff
       if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-changelog-needed') }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3f888004e97..5b2601608a3 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-  pull_request:
   schedule:
     # Prime the caches every Monday
     - cron: 0 1 * * MON
@@ -17,9 +16,8 @@ jobs:
       matrix:
         os:
           - ubuntu-latest
-        packages: [ '.' ]
         ocaml-compiler:
-          - 4.13.x
+          - 5.1.x
 
     runs-on: ${{ matrix.os }}
 
@@ -30,38 +28,26 @@ jobs:
           git config --global core.eol lf
 
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Use OCaml ${{ matrix.ocaml-compiler }}
         uses: ocaml/setup-ocaml@v2
         with:
           ocaml-compiler: ${{ matrix.ocaml-compiler }}
-          opam-local-packages: $${ matrix.opam-local-packages }}
-          opam-depext-flags: --with-test
-
-      - name: Pin local packages
-        run: |
-          # Pin all local opam files to avoid internal conflicts
-          # 
-          # TODO: replace with `opam pin --with-version` when Opam 2.1 is
-          # available via `setup-ocaml`.
-          find . -maxdepth 1 -name '*.opam' -printf '%P\n' |\
-              cut -d. -f1 |\
-              xargs -I{} -n 1 opam pin add {}.dev ./ -n
-
-      - name: Install depexts
-        run: |
-          find . -maxdepth 1 -name '*.opam' -printf '%P\n' |\
-             cut -d. -f1 |\
-             xargs opam depext --update -y
 
       - name: Install Opam dependencies
-        run: opam install ${{ matrix.packages }} --with-test --deps-only
+        run: opam install . --with-test --deps-only
+
+      - name: Build
+        run: opam exec -- dune build
 
       - name: Run tests with coverage instrumentation
         run: opam exec -- dune runtest --instrument-with bisect_ppx
 
       - name: Send coverage report to Codecov
-        run: opam exec -- bisect-ppx-report send-to Codecov
+        run: opam exec -- bisect-ppx-report send-to Codecov --verbose
         env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
           PULL_REQUEST_NUMBER: ${{ github.event.number }}
diff --git a/.github/workflows/git.yml b/.github/workflows/git.yml
index 17183416778..2cbbf6622e6 100644
--- a/.github/workflows/git.yml
+++ b/.github/workflows/git.yml
@@ -8,6 +8,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2.0.0
+      - uses: actions/checkout@v4
       - name: Block Fixup Commit Merge
         uses: 13rac1/block-fixup-merge-action@v2.0.0
diff --git a/CHANGES.md b/CHANGES.md
index 19e2e71aef7..daa2ab9ab5c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -6,6 +6,8 @@
 
 - **irmin-client**
   - Fix a fd lead when using `clone` (#2322, @samoht)
+- **irmin**
+  - Fix CI, update dependencies (#2321, @smorimoto)
 
 ### Removed
 
diff --git a/irmin-client.opam b/irmin-client.opam
index ceb76e04469..9497aa836d4 100644
--- a/irmin-client.opam
+++ b/irmin-client.opam
@@ -22,6 +22,8 @@ depends: [
   "logs" {>= "0.7.0"}
   "lwt" {>= "5.7.0"}
   "irmin-test" {= version & with-test}
+  "alcotest-lwt" {with-test & >= "1.8.0"}
+  "irmin-watcher" {with-test & >= "0.5.0"}
 ]
 build: [
   ["dune" "subst"] {pinned}
diff --git a/src/libirmin/lib/dune b/src/libirmin/lib/dune
index dbfd80157a6..5664d7a29ba 100644
--- a/src/libirmin/lib/dune
+++ b/src/libirmin/lib/dune
@@ -7,25 +7,18 @@
 
 (executable
  (name libirmin)
- (package libirmin)
- (public_name libirmin)
  (libraries libirmin_bindings)
- (modes
-  (native shared_object)
-  native)
+ (modes shared_object)
  (modules libirmin irmin_bindings)
  (foreign_stubs
   (language c)
-  (names irmin)))
+  (names irmin))
+ (flags
+  (:standard -w -unused-var-strict -ccopt "-Wl,-znow")))
 
 (install
  (package libirmin)
  (section lib)
  (files
   (irmin.h as include/irmin.h)
-  (libirmin.so as lib/libirmin.so)))
-
-(env
- (dev
-  (flags
-   (:standard -w -unused-var-strict))))
+  (libirmin%{ext_dll} as lib/libirm%{ext_dll})))
diff --git a/src/libirmin/util.ml b/src/libirmin/util.ml
index 52136931316..812d13c47e3 100644
--- a/src/libirmin/util.ml
+++ b/src/libirmin/util.ml
@@ -49,7 +49,7 @@ module Make (I : Cstubs_inverted.INTERNAL) = struct
     match Lwt.poll x with
     | Some x -> x
     | None ->
-        let () = Lwt_engine.iter true in
+        let () = Lwt_engine.iter false in
         run x
 
   module Root = struct
diff --git a/test/irmin-client/dune b/test/irmin-client/dune
index 0a2920ca17b..3ce7abc8175 100644
--- a/test/irmin-client/dune
+++ b/test/irmin-client/dune
@@ -9,4 +9,6 @@
   conduit-lwt-unix
   alcotest-lwt
   irmin-test
-  irmin-watcher))
+  irmin-watcher)
+ (enabled_if
+  (<> %{system} "freebsd")))
diff --git a/test/irmin-graphql/dune b/test/irmin-graphql/dune
index 5f8d03744e6..f0728ae2623 100644
--- a/test/irmin-graphql/dune
+++ b/test/irmin-graphql/dune
@@ -16,4 +16,6 @@
  (alias runtest)
  (package irmin-graphql)
  (action
-  (run ./test.exe -q --color=always)))
+  (run ./test.exe -q --color=always))
+ (enabled_if
+  (<> %{system} "freebsd")))