diff --git a/AGENTS.md b/AGENTS.md
index c1d5a46..43452d3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -42,8 +42,8 @@ devcontainer features test .
 | `playwright-dev` | 1.2.3 | Playwright OS deps (Chromium/Firefox/WebKit) + shared browser-binary volume + VS Code extension |
 | `pnpm-store` | 1.2.4 | Shared pnpm store via Docker named volume (dependsOn helpers4-common) |
 | `auto-header` | 1.2.3 | LGPL-3.0 license headers |
-| `git-absorb` | 1.2.2 | git-absorb from GitHub releases |
-| `bitwarden-secrets-manager` | 1.2.3 | `bws` CLI from bitwarden/sdk-sm GitHub releases, token-only auth, no persisted state |
+| `git-absorb` | 1.2.3 | git-absorb from GitHub releases |
+| `bitwarden-secrets-manager` | 1.2.4 | `bws` CLI from bitwarden/sdk-sm GitHub releases, token-only auth, no persisted state |
 | `dotfiles-sync` | 1.2.3 | Sync Git/SSH/GPG/npm/gh config from host; SSH key files opt-in (dependsOn helpers4-common) |
 | `peon-ping` | 1.2.3 | AI agent sound notifications |
 | `shell-history-per-project` | 1.2.3 | Persistent shell history (zsh/bash/fish) |
diff --git a/src/bitwarden-secrets-manager/README.md b/src/bitwarden-secrets-manager/README.md
index adeb625..e5e8404 100644
--- a/src/bitwarden-secrets-manager/README.md
+++ b/src/bitwarden-secrets-manager/README.md
@@ -71,6 +71,9 @@ Supported architectures: `x86_64` and `aarch64`/`arm64` (e.g. Oracle Cloud Amper
 
 ## Version History
 
+- **v1.2.4**: Internal refactor, no behavior change — architecture detection and latest-release
+  resolution now call `helpers4-common`'s `h4_arch_musl_triple` and `h4_github_latest_tag`
+  instead of carrying inline copies of the same logic.
 - **v1.2.3**: Documentation only, no functional change — added a "When to use this" section
   with alternatives, matching the equivalent sections other features in this catalog already had.
 - **v1.2.2**: Documentation only, no functional change — the previous wording sweep made the
diff --git a/src/bitwarden-secrets-manager/devcontainer-feature.json b/src/bitwarden-secrets-manager/devcontainer-feature.json
index 863b9a2..08c64c5 100644
--- a/src/bitwarden-secrets-manager/devcontainer-feature.json
+++ b/src/bitwarden-secrets-manager/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
   "id": "bitwarden-secrets-manager",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "name": "Bitwarden Secrets Manager CLI",
   "description": "Installs bws, the official Bitwarden Secrets Manager CLI, from bitwarden/sdk-sm GitHub releases. Non-interactive, machine-account-token auth only (BWS_ACCESS_TOKEN) — no vault login, no persisted state, no bind mounts. Also self-heals your devcontainer setup.",
   "documentationURL": "https://github.com/helpers4/devcontainer/tree/main/src/bitwarden-secrets-manager",
diff --git a/src/bitwarden-secrets-manager/install.sh b/src/bitwarden-secrets-manager/install.sh
index dadce60..04bd01f 100644
--- a/src/bitwarden-secrets-manager/install.sh
+++ b/src/bitwarden-secrets-manager/install.sh
@@ -42,11 +42,7 @@ h4_ensure_packages curl ca-certificates unzip
 case "${BWS_VERSION_INPUT}" in
     latest)
         echo "  📦 Fetching latest bws release..."
-        # grep -o exits 1 on no match, which under pipefail would otherwise
-        # kill the script right here — before the check below ever runs — on
-        # any transient API hiccup, with no diagnostic. The trailing
-        # `|| true` lets that check do its job instead.
-        BWS_TAG="$(curl -s "https://api.github.com/repos/bitwarden/sdk-sm/releases" | grep -o '"tag_name": *"bws-[^"]*"' | head -1 | cut -d'"' -f4 || true)"
+        BWS_TAG="$(h4_github_latest_tag bitwarden/sdk-sm bws-)"
         if [ -z "${BWS_TAG}" ]; then
             echo "(!) Failed to fetch latest bws release"
             exit 1
@@ -66,12 +62,7 @@ VERSION_NUMBER="${BWS_TAG#bws-v}"
 # built, never on the host — so unlike bws's own multi-OS releases, there is
 # no Darwin case to detect here. Only the architecture varies (Oracle Cloud
 # Ampere A1 targets are aarch64).
-architecture="$(uname -m)"
-case "${architecture}" in
-    x86_64) target="x86_64-unknown-linux-musl" ;;
-    aarch64 | arm64) target="aarch64-unknown-linux-musl" ;;
-    *) echo "(!) Architecture ${architecture} unsupported"; exit 1 ;;
-esac
+target="$(h4_arch_musl_triple)" || exit 1
 
 ASSET_NAME="bws-${target}-${VERSION_NUMBER}.zip"
 CHECKSUMS_NAME="bws-sha256-checksums-${VERSION_NUMBER}.txt"
diff --git a/src/git-absorb/README.md b/src/git-absorb/README.md
index 5d97143..5a109be 100644
--- a/src/git-absorb/README.md
+++ b/src/git-absorb/README.md
@@ -155,6 +155,9 @@ This feature is part of the `helpers4/devcontainer-features` repository. Contrib
 
 ## Version History
 
+- **v1.2.3**: Internal refactor, no behavior change — architecture detection and latest-release
+  resolution now call `helpers4-common`'s `h4_arch_musl_triple` and `h4_github_latest_tag`
+  instead of carrying inline copies of the same logic.
 - **v1.2.2**: Documentation only, no functional change — the previous wording sweep made the
   JSON `description` field far too long, shifting focus away from the feature itself onto the
   self-heal side benefit. Shortened to 5 words and kept generic (no implementation detail like
diff --git a/src/git-absorb/devcontainer-feature.json b/src/git-absorb/devcontainer-feature.json
index 8a91be8..009b2f5 100644
--- a/src/git-absorb/devcontainer-feature.json
+++ b/src/git-absorb/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
   "id": "git-absorb",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "name": "git absorb — Automatic Fixup Commits",
   "description": "Installs git-absorb, a tool to automatically absorb staged changes into their logical commits. Like 'git commit --fixup' but automatic. Also self-heals your devcontainer setup.",
   "documentationURL": "https://github.com/helpers4/devcontainer/tree/main/src/git-absorb",
diff --git a/src/git-absorb/install.sh b/src/git-absorb/install.sh
index e64d41c..7c57f4d 100755
--- a/src/git-absorb/install.sh
+++ b/src/git-absorb/install.sh
@@ -46,19 +46,14 @@ if ! command -v git > /dev/null 2>&1; then
 fi
 
 # Detect architecture
-architecture="$(uname -m)"
-case $architecture in
-    x86_64) architecture="x86_64-unknown-linux-musl";;
-    aarch64 | armv8*) architecture="aarch64-unknown-linux-musl";;
-    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
-esac
+architecture="$(h4_arch_musl_triple)" || exit 1
 
 # Install git-absorb
 echo "🎯 Installing git-absorb..."
 
 if [ "${GIT_ABSORB_VERSION}" = "latest" ]; then
     echo "  📦 Fetching latest version..."
-    GIT_ABSORB_VERSION=$(curl -s "https://api.github.com/repos/tummychow/git-absorb/releases/latest" | grep -o '"tag_name": "[^"]*"' | cut -d'"' -f4)
+    GIT_ABSORB_VERSION=$(h4_github_latest_tag tummychow/git-absorb)
     if [ -z "${GIT_ABSORB_VERSION}" ]; then
         echo "(!) Failed to fetch latest version"
         exit 1