diff --git a/.github/actions/get-branch-info/action.yml b/.github/actions/get-branch-info/action.yml
new file mode 100644
index 00000000..c58d2476
--- /dev/null
+++ b/.github/actions/get-branch-info/action.yml
@@ -0,0 +1,86 @@
+name: Get branch info
+description: Extract branch metadata and derived values for the workflow
+
+inputs:
+  trunk_version:
+    required: false
+    default: ""
+    description: Major version to use when the branch resolves to trunk
+  trunk_git_branch:
+    required: false
+    default: ""
+    description: Git ref to use for scheduled runs
+
+outputs:
+  is_default_branch:
+    description: Whether the current branch is the default branch
+    value: ${{ steps.branch_info.outputs.is_default_branch }}
+  current_branch:
+    description: Normalized current branch or tag name
+    value: ${{ steps.branch_info.outputs.current_branch }}
+  secret_prefix:
+    description: Derived secret prefix for the current branch
+    value: ${{ steps.branch_info.outputs.secret_prefix }}
+  sha_short:
+    description: Short Git commit SHA
+    value: ${{ steps.branch_info.outputs.sha_short }}
+
+runs:
+  using: composite
+  steps:
+    - name: Get branch info
+      id: branch_info
+      shell: bash
+      env:
+        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        GITHUB_REF_RAW: ${{ github.ref }}
+        GITHUB_EVENT_NAME: ${{ github.event_name }}
+        TRUNK_MAJOR_VERSION: ${{ inputs.trunk_version }}
+        TRUNK_GIT_BRANCH: ${{ inputs.trunk_git_branch }}
+      run: |
+        set -euo pipefail
+
+        if [[ "$GITHUB_EVENT_NAME" == "schedule" ]]; then
+          if [[ -z "$TRUNK_GIT_BRANCH" ]]; then
+            echo "TRUNK_GIT_BRANCH must be set for schedule events" >&2
+            exit 1
+          fi
+          ref="$TRUNK_GIT_BRANCH"
+        else
+          ref="$GITHUB_REF_RAW"
+        fi
+
+        sha_short="$(git rev-parse --short HEAD)"
+
+        if [[ "$ref" == refs/tags/* ]]; then
+          ref="${ref%.*}"
+        fi
+
+        current_branch="${ref##*/}"
+        is_default_branch=false
+
+        if [[ "$current_branch" == "$DEFAULT_BRANCH" ]]; then
+          is_default_branch=true
+        fi
+
+        if [[ "${current_branch//.}" == "trunk" && -n "$TRUNK_MAJOR_VERSION" ]]; then
+          secret_prefix="RHEL_${TRUNK_MAJOR_VERSION//.}"
+        else
+          secret_prefix="RHEL_${current_branch//.}"
+        fi
+
+        echo "::group::Branch metadata"
+        echo "event_name=$GITHUB_EVENT_NAME"
+        echo "ref=$ref"
+        echo "is_default_branch=$is_default_branch"
+        echo "current_branch=$current_branch"
+        echo "secret_prefix=$secret_prefix"
+        echo "sha_short=$sha_short"
+        echo "::endgroup::"
+
+        {
+          echo "is_default_branch=$is_default_branch"
+          echo "current_branch=$current_branch"
+          echo "secret_prefix=$secret_prefix"
+          echo "sha_short=$sha_short"
+        } >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/images_build_windows.yml b/.github/workflows/images_build_windows.yml
index 8e579920..46d8b490 100644
--- a/.github/workflows/images_build_windows.yml
+++ b/.github/workflows/images_build_windows.yml
@@ -35,7 +35,6 @@ env:
 
   DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
   DOCKER_REPOSITORY: ${{ vars.DOCKER_REPOSITORY }}
-  LATEST_BRANCH: ${{ github.event.repository.default_branch }}
   TRUNK_GIT_BRANCH: "refs/heads/trunk"
   IMAGES_PREFIX: "zabbix-"
 
@@ -119,34 +118,10 @@ jobs:
 
       - name: Get branch info
         id: branch_info
-        shell: bash
-        env:
-          LATEST_BRANCH: ${{ env.LATEST_BRANCH }}
-          GITHUB_REF_RAW: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || github.ref }}
-        run: |
-          github_ref="$GITHUB_REF_RAW"
-          sha_short="$(git rev-parse --short HEAD)"
-
-          if [[ "$github_ref" == refs/tags/* ]]; then
-            github_ref="${github_ref%.*}"
-          fi
-
-          github_ref="${github_ref##*/}"
-
-          is_default_branch=false
-          if [[ "$github_ref" == "$LATEST_BRANCH" ]]; then
-            is_default_branch=true
-          fi
-
-          echo "::group::Branch data"
-          echo "is_default_branch=$is_default_branch"
-          echo "current_branch=$github_ref"
-          echo "sha_short=$sha_short"
-          echo "::endgroup::"
-
-          echo "is_default_branch=$is_default_branch" >> "$GITHUB_OUTPUT"
-          echo "current_branch=$github_ref" >> "$GITHUB_OUTPUT"
-          echo "sha_short=$sha_short" >> "$GITHUB_OUTPUT"
+        uses: ./.github/actions/get-branch-info
+        with:
+          trunk_version: ${{ inputs.trunk_version }}
+          trunk_git_branch: ${{ env.TRUNK_GIT_BRANCH }}
 
   build_base:
     name: Build ${{ matrix.component }} base on ${{ matrix.os }}
@@ -471,6 +446,12 @@ jobs:
         component: ${{ fromJson(needs.init_build.outputs.components) }}
 
     steps:
+      - name: Block egress traffic
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with: