diff --git a/go.mod b/go.mod
index 8c0e416..c86695b 100644
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.27.1
 
 require (
 	github.com/bradleyfalzon/ghinstallation/v2 v2.19.0
-	github.com/google/go-github/v90 v90.0.0
+	github.com/google/go-github/v91 v91.0.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	golang.org/x/oauth2 v0.36.0
diff --git a/go.sum b/go.sum
index e9f44e2..1910ae2 100644
--- a/go.sum
+++ b/go.sum
@@ -8,8 +8,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
 github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
-github.com/google/go-github/v90 v90.0.0 h1:EnX9HvTfqvuJbUSWu1/jLrYH6JJLMz0w0qfQVbTxPzE=
-github.com/google/go-github/v90 v90.0.0/go.mod h1:pLzt1FZURZyoTHT5/Z1UQY3b9fYyrbXH6aj7X+qgID4=
+github.com/google/go-github/v91 v91.0.0 h1:fpulREh37uBvOj4kF0vLuzjwJ1HHmFcAfquNjJfmpYs=
+github.com/google/go-github/v91 v91.0.0/go.mod h1:rHtn7haKvmkTLhUK/aCQypiIj/suWSB3rnS+a1FdH6M=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
diff --git a/internal/gh/client.go b/internal/gh/client.go
index aacc865..269f1b6 100644
--- a/internal/gh/client.go
+++ b/internal/gh/client.go
@@ -16,7 +16,7 @@ import (
 	"time"
 
 	"github.com/bradleyfalzon/ghinstallation/v2"
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 	"golang.org/x/oauth2"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
diff --git a/internal/gh/installations.go b/internal/gh/installations.go
index cc8dd60..961a9f6 100644
--- a/internal/gh/installations.go
+++ b/internal/gh/installations.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 )
 
 // accountTypeOrganization is what GitHub calls an installation account that is
diff --git a/internal/gh/installations_test.go b/internal/gh/installations_test.go
index 5bd0edc..53f0160 100644
--- a/internal/gh/installations_test.go
+++ b/internal/gh/installations_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 )
diff --git a/internal/gh/rate.go b/internal/gh/rate.go
index 7a87c52..98560e2 100644
--- a/internal/gh/rate.go
+++ b/internal/gh/rate.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/util"
 )
diff --git a/internal/gh/rate_test.go b/internal/gh/rate_test.go
index 6656200..8212894 100644
--- a/internal/gh/rate_test.go
+++ b/internal/gh/rate_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 )
 
 func TestRespectRate_Healthy(t *testing.T) {
diff --git a/internal/sync/apply_handlers.go b/internal/sync/apply_handlers.go
index 650dc52..5745d77 100644
--- a/internal/sync/apply_handlers.go
+++ b/internal/sync/apply_handlers.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/gh"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -52,14 +52,14 @@ func applyTeamCreate(ctx context.Context, c *gh.Client, ch util.Change) error {
 	name := detailString(d, "name")
 	var privacyPtr, descPtr *string
 	if pv := detailString(d, "privacy"); pv != "" {
-		privacyPtr = github.Ptr(pv)
+		privacyPtr = new(pv)
 	}
 	if dv := detailString(d, "description"); dv != "" {
-		descPtr = github.Ptr(dv)
+		descPtr = new(dv)
 	}
-	newTeam := github.NewTeam{Name: name, Privacy: privacyPtr, Description: descPtr}
+	newTeam := github.CreateTeamRequest{Name: name, Privacy: privacyPtr, Description: descPtr}
 	if nv := detailString(d, "notification_setting"); nv != "" {
-		newTeam.NotificationSetting = github.Ptr(nv)
+		newTeam.NotificationSetting = new(nv)
 	}
 	// The plan names the parent by slug, because at plan time the parent may
 	// not exist yet and so has no ID to name it by. hierarchyOrder guarantees
@@ -69,7 +69,7 @@ func applyTeamCreate(ctx context.Context, c *gh.Client, ch util.Change) error {
 		if err != nil {
 			return fmt.Errorf("create team %q: %w", name, err)
 		}
-		newTeam.ParentTeamID = github.Ptr(id)
+		newTeam.ParentTeamID = new(id)
 	}
 	_, _, err = c.REST.Teams.CreateTeam(ctx, org, newTeam)
 	if err != nil {
@@ -99,32 +99,33 @@ func applyTeamUpdate(ctx context.Context, c *gh.Client, ch util.Change) error {
 	org := detailString(d, "org")
 	slug := detailString(d, "slug")
 	name := detailString(d, "name")
-	newTeam := github.NewTeam{Name: name}
+	newTeam := github.UpdateTeamRequest{Name: new(name)}
 	// Presence of the key, not truthiness of the value. planTeams only includes
 	// "description" when it differs, so an empty one means "clear it" — and
 	// skipping it left the planner detecting a removal the apply never sent,
 	// re-planning the same change on every run while the description stayed.
 	if dv, ok := d["description"]; ok {
-		newTeam.Description = github.Ptr(fmt.Sprint(dv))
+		newTeam.Description = new(fmt.Sprint(dv))
 	}
 	if pv := detailString(d, "privacy"); pv != "" {
-		newTeam.Privacy = github.Ptr(pv)
+		newTeam.Privacy = new(pv)
 	}
 	if nv := detailString(d, "notification_setting"); nv != "" {
-		newTeam.NotificationSetting = github.Ptr(nv)
+		newTeam.NotificationSetting = new(nv)
 	}
 	// parent_team_id carries omitempty, so leaving it nil preserves whatever
-	// nesting the team already has. Clearing one takes the separate
-	// removeParent argument, which is why the planner distinguishes the two.
-	removeParent := detailBool(d, "remove_parent")
-	if parent := detailString(d, "parent"); parent != "" && !removeParent {
+	// nesting the team already has. Clearing one takes RemoveParentTeam, whose
+	// marshaller sends an explicit null instead, which is why the planner
+	// distinguishes the two.
+	newTeam.RemoveParentTeam = detailBool(d, "remove_parent")
+	if parent := detailString(d, "parent"); parent != "" && !newTeam.RemoveParentTeam {
 		id, err := parentTeamID(ctx, c, org, parent)
 		if err != nil {
 			return fmt.Errorf("update team %q: %w", slug, err)
 		}
-		newTeam.ParentTeamID = github.Ptr(id)
+		newTeam.ParentTeamID = new(id)
 	}
-	_, _, err = c.REST.Teams.EditTeamBySlug(ctx, org, slug, newTeam, removeParent)
+	_, _, err = c.REST.Teams.UpdateTeamBySlug(ctx, org, slug, newTeam)
 	if err != nil {
 		return fmt.Errorf("update team %q: %w", slug, err)
 	}
@@ -191,8 +192,8 @@ func applyRepoEnsure(ctx context.Context, c *gh.Client, ch util.Change) error {
 
 		_, _, err := c.REST.Repositories.CreateFromTemplate(ctx, templateOrg, templateRepo, github.TemplateRepoRequest{
 			Name:    name,
-			Owner:   github.Ptr(org),
-			Private: github.Ptr(private),
+			Owner:   new(org),
+			Private: new(private),
 		})
 		if err != nil {
 			if !isRepoAlreadyExists(err) {
@@ -202,16 +203,16 @@ func applyRepoEnsure(ctx context.Context, c *gh.Client, ch util.Change) error {
 		}
 	} else {
 		repo := &github.Repository{
-			Name:                github.Ptr(name),
-			Private:             github.Ptr(private),
-			IsTemplate:          github.Ptr(isTemplate),
-			AllowAutoMerge:      github.Ptr(true),
-			AllowMergeCommit:    github.Ptr(false),
-			DeleteBranchOnMerge: github.Ptr(true),
-			HasIssues:           github.Ptr(true),
+			Name:                new(name),
+			Private:             new(private),
+			IsTemplate:          new(isTemplate),
+			AllowAutoMerge:      new(true),
+			AllowMergeCommit:    new(false),
+			DeleteBranchOnMerge: new(true),
+			HasIssues:           new(true),
 		}
 		if visibility != "" {
-			repo.Visibility = github.Ptr(visibility)
+			repo.Visibility = new(visibility)
 		}
 		_, _, err := c.REST.Repositories.Create(ctx, org, repo)
 		if err != nil {
@@ -307,9 +308,9 @@ func applyRepoFileEnsure(ctx context.Context, c *gh.Client, ch util.Change) erro
 	}
 	if file == nil {
 		_, _, err := c.REST.Repositories.CreateFile(ctx, org, repo, path, &github.RepositoryContentFileOptions{
-			Message: github.Ptr(message),
+			Message: new(message),
 			Content: content,
-			Branch:  github.Ptr(branch),
+			Branch:  new(branch),
 		})
 		if err != nil {
 			// Handle race condition: If repository was created from template,
@@ -340,10 +341,10 @@ func applyRepoFileEnsure(ctx context.Context, c *gh.Client, ch util.Change) erro
 		return nil
 	}
 	_, _, err = c.REST.Repositories.UpdateFile(ctx, org, repo, path, &github.RepositoryContentFileOptions{
-		Message: github.Ptr(message),
+		Message: new(message),
 		Content: content,
-		Branch:  github.Ptr(branch),
-		SHA:     github.Ptr(file.GetSHA()),
+		Branch:  new(branch),
+		SHA:     new(file.GetSHA()),
 	})
 	if err != nil {
 		return fmt.Errorf("update file %s in %s/%s: %w", path, org, repo, err)
@@ -369,9 +370,9 @@ func applyRepoFileDelete(ctx context.Context, c *gh.Client, ch util.Change) erro
 		return nil
 	}
 	_, _, err = c.REST.Repositories.DeleteFile(ctx, org, repo, path, &github.RepositoryContentFileOptions{
-		Message: github.Ptr(message),
-		Branch:  github.Ptr(branch),
-		SHA:     github.Ptr(file.GetSHA()),
+		Message: new(message),
+		Branch:  new(branch),
+		SHA:     new(file.GetSHA()),
 	})
 	if err != nil {
 		return fmt.Errorf("delete file %s in %s/%s: %w", path, org, repo, err)
@@ -420,7 +421,7 @@ func applyRepoTemplateEnsure(ctx context.Context, c *gh.Client, ch util.Change)
 	repo := detailString(d, "repo")
 
 	_, _, err = c.REST.Repositories.Edit(ctx, org, repo, &github.Repository{
-		IsTemplate: github.Ptr(true),
+		IsTemplate: new(true),
 	})
 	if err != nil {
 		return fmt.Errorf("mark repo %s/%s as template: %w", org, repo, err)
@@ -465,7 +466,7 @@ func applyOrgOwnerEnsure(ctx context.Context, c *gh.Client, ch util.Change) erro
 	org := detailString(d, "org")
 	user := detailString(d, "user")
 	_, _, err = c.REST.Organizations.EditOrgMembership(ctx, user, org, &github.Membership{
-		Role: github.Ptr(orgRoleAdmin),
+		Role: new(orgRoleAdmin),
 	})
 	if err != nil {
 		return fmt.Errorf("make %q an owner of org %q: %w", user, org, err)
@@ -485,7 +486,7 @@ func applyOrgOwnerRemove(ctx context.Context, c *gh.Client, ch util.Change) erro
 	org := detailString(d, "org")
 	user := detailString(d, "user")
 	_, _, err = c.REST.Organizations.EditOrgMembership(ctx, user, org, &github.Membership{
-		Role: github.Ptr(orgRoleMember),
+		Role: new(orgRoleMember),
 	})
 	if err != nil {
 		return fmt.Errorf("demote owner %q of org %q to member: %w", user, org, err)
diff --git a/internal/sync/apply_handlers_test.go b/internal/sync/apply_handlers_test.go
index 1bcccd0..9b70cb5 100644
--- a/internal/sync/apply_handlers_test.go
+++ b/internal/sync/apply_handlers_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/archive.go b/internal/sync/archive.go
index 535c2f8..2c799e1 100644
--- a/internal/sync/archive.go
+++ b/internal/sync/archive.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -150,7 +150,7 @@ func applyRepoArchiveEnsure(ctx context.Context, c *gh.Client, ch util.Change) e
 	archived := detailBool(d, detailArchived)
 
 	_, _, err = c.REST.Repositories.Edit(ctx, org, repo, &github.Repository{
-		Archived: github.Ptr(archived),
+		Archived: new(archived),
 	})
 	if err != nil {
 		verb := "archive"
diff --git a/internal/sync/archive_test.go b/internal/sync/archive_test.go
index c797743..aae0fc3 100644
--- a/internal/sync/archive_test.go
+++ b/internal/sync/archive_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -17,7 +17,7 @@ import (
 func boolPtr(b bool) *bool { return &b }
 
 func repoFixture(name string, archived bool) *github.Repository {
-	return &github.Repository{Name: github.Ptr(name), Archived: github.Ptr(archived)}
+	return &github.Repository{Name: new(name), Archived: new(archived)}
 }
 
 // Omitting `archived:` and setting it to false are different instructions. An
diff --git a/internal/sync/collaborators.go b/internal/sync/collaborators.go
index 24744aa..bae8e6b 100644
--- a/internal/sync/collaborators.go
+++ b/internal/sync/collaborators.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/collaborators_test.go b/internal/sync/collaborators_test.go
index 628afea..9a4293b 100644
--- a/internal/sync/collaborators_test.go
+++ b/internal/sync/collaborators_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -123,7 +123,7 @@ func (w collabWorld) state() *State {
 		st.ManagedRepos[repo] = true
 	}
 	for _, slug := range w.teams {
-		st.ActualTeams = append(st.ActualTeams, &github.Team{Slug: github.Ptr(slug)})
+		st.ActualTeams = append(st.ActualTeams, &github.Team{Slug: new(slug)})
 	}
 	return st
 }
@@ -345,8 +345,8 @@ func TestPlanCollaboratorsFollowsParentInheritance(t *testing.T) {
 
 func TestCollaboratorPermissionPrefersRoleName(t *testing.T) {
 	u := &github.User{
-		RoleName:    github.Ptr("write"),
-		Permissions: &github.RepositoryPermissions{Pull: github.Ptr(true)},
+		RoleName:    new("write"),
+		Permissions: &github.RepositoryPermissions{Pull: new(true)},
 	}
 	if got := collaboratorPermission(u); got != permPush {
 		t.Errorf("role_name should win and normalize to push, got %q", got)
@@ -355,7 +355,7 @@ func TestCollaboratorPermissionPrefersRoleName(t *testing.T) {
 
 func TestCollaboratorPermissionFallsBackToPermissionBlock(t *testing.T) {
 	u := &github.User{Permissions: &github.RepositoryPermissions{
-		Pull: github.Ptr(true), Push: github.Ptr(true), Maintain: github.Ptr(true),
+		Pull: new(true), Push: new(true), Maintain: new(true),
 	}}
 	if got := collaboratorPermission(u); got != permMaintain {
 		t.Errorf("want maintain, got %q", got)
diff --git a/internal/sync/custom_roles.go b/internal/sync/custom_roles.go
index 0afb7b9..8c3f936 100644
--- a/internal/sync/custom_roles.go
+++ b/internal/sync/custom_roles.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -197,7 +197,7 @@ func applyCustomRoleChanges(ctx context.Context, c *gh.Client, changes []util.Ch
 				Permissions: d.Permissions,
 			}
 			if d.Description != "" {
-				req.Description = github.Ptr(d.Description)
+				req.Description = new(d.Description)
 			}
 
 			_, _, err := c.REST.Organizations.CreateCustomRepoRole(ctx, d.Org, req)
@@ -208,12 +208,12 @@ func applyCustomRoleChanges(ctx context.Context, c *gh.Client, changes []util.Ch
 
 		case "custom-role:update":
 			req := github.UpdateCustomRepoRoleRequest{
-				Name:        github.Ptr(d.Name),
-				BaseRole:    github.Ptr(d.BaseRole),
+				Name:        new(d.Name),
+				BaseRole:    new(d.BaseRole),
 				Permissions: d.Permissions,
 			}
 			if d.Description != "" {
-				req.Description = github.Ptr(d.Description)
+				req.Description = new(d.Description)
 			}
 
 			_, _, err := c.REST.Organizations.UpdateCustomRepoRole(ctx, d.Org, d.ID, req)
diff --git a/internal/sync/file_strategy_test.go b/internal/sync/file_strategy_test.go
index 1fab8ff..4cdb3d4 100644
--- a/internal/sync/file_strategy_test.go
+++ b/internal/sync/file_strategy_test.go
@@ -3,7 +3,7 @@ package sync
 import (
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 )
@@ -15,8 +15,8 @@ func deciderFor(t *testing.T, org []config.RulesetConfig, perRepo map[string][]c
 	cfg.Org.Rulesets = org
 
 	st := &State{Org: "myorg", ActualRepos: []*github.Repository{
-		{Name: github.Ptr("infra"), DefaultBranch: github.Ptr("main")},
-		{Name: github.Ptr("legacy"), DefaultBranch: github.Ptr("master")},
+		{Name: new("infra"), DefaultBranch: new("main")},
+		{Name: new("legacy"), DefaultBranch: new("master")},
 	}}
 	settings := map[string]repoSettings{}
 	for repo, rs := range perRepo {
diff --git a/internal/sync/files.go b/internal/sync/files.go
index 3086560..c582ac8 100644
--- a/internal/sync/files.go
+++ b/internal/sync/files.go
@@ -7,7 +7,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/files_pr.go b/internal/sync/files_pr.go
index 54c9364..7650990 100644
--- a/internal/sync/files_pr.go
+++ b/internal/sync/files_pr.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/gh"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -118,9 +118,9 @@ func writeFileOnBranch(ctx context.Context, c *gh.Client, org, repo, path, branc
 	}
 
 	opts := &github.RepositoryContentFileOptions{
-		Message: github.Ptr(message),
+		Message: new(message),
 		Content: content,
-		Branch:  github.Ptr(branch),
+		Branch:  new(branch),
 	}
 	if file == nil {
 		if _, _, err := c.REST.Repositories.CreateFile(ctx, org, repo, path, opts); err != nil {
@@ -136,7 +136,7 @@ func writeFileOnBranch(ctx context.Context, c *gh.Client, org, repo, path, branc
 	if current == string(content) {
 		return nil
 	}
-	opts.SHA = github.Ptr(file.GetSHA())
+	opts.SHA = new(file.GetSHA())
 	if _, _, err := c.REST.Repositories.UpdateFile(ctx, org, repo, path, opts); err != nil {
 		return fmt.Errorf("update %s on %s/%s@%s: %w", path, org, repo, branch, err)
 	}
@@ -160,10 +160,10 @@ func ensurePullRequest(ctx context.Context, c *gh.Client, org, repo, base, head,
 
 	title, body := splitCommitMessage(message)
 	pr, _, err := c.REST.PullRequests.Create(ctx, org, repo, github.CreatePullRequest{
-		Title: github.Ptr(title),
+		Title: new(title),
 		Head:  head,
 		Base:  base,
-		Body:  github.Ptr(body),
+		Body:  new(body),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("open pull request on %s/%s: %w", org, repo, err)
diff --git a/internal/sync/files_pr_test.go b/internal/sync/files_pr_test.go
index 8bb6c8f..86724c8 100644
--- a/internal/sync/files_pr_test.go
+++ b/internal/sync/files_pr_test.go
@@ -10,7 +10,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/gh"
 	"github.com/DragonSecurity/gomgr/internal/util"
diff --git a/internal/sync/orchestrator.go b/internal/sync/orchestrator.go
index 08d834d..e2551d4 100644
--- a/internal/sync/orchestrator.go
+++ b/internal/sync/orchestrator.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/owners.go b/internal/sync/owners.go
index de9a04c..9feef52 100644
--- a/internal/sync/owners.go
+++ b/internal/sync/owners.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/plan_hierarchy_test.go b/internal/sync/plan_hierarchy_test.go
index 07c2c5a..abf1468 100644
--- a/internal/sync/plan_hierarchy_test.go
+++ b/internal/sync/plan_hierarchy_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -49,8 +49,8 @@ func TestPlanTeamsPlansAReParent(t *testing.T) {
 		config.TeamConfig{Name: "Oncall", Slug: "oncall", Parents: []string{"platform"}},
 	)
 	st := &State{Org: "myorg", ActualTeams: []*github.Team{
-		{Slug: github.Ptr("platform")},
-		{Slug: github.Ptr("oncall")},
+		{Slug: new("platform")},
+		{Slug: new("oncall")},
 	}}
 
 	changes, _, err := planTeams(context.Background(), nil, cfg, st)
@@ -70,7 +70,7 @@ func TestPlanTeamsPlansAReParent(t *testing.T) {
 func TestPlanTeamsPlansAnUnNesting(t *testing.T) {
 	cfg := hierarchyCfg(config.TeamConfig{Name: "Oncall", Slug: "oncall"})
 	st := &State{Org: "myorg", ActualTeams: []*github.Team{
-		{Slug: github.Ptr("oncall"), Parent: &github.Team{Slug: github.Ptr("platform")}},
+		{Slug: new("oncall"), Parent: &github.Team{Slug: new("platform")}},
 	}}
 
 	changes, _, err := planTeams(context.Background(), nil, cfg, st)
@@ -93,7 +93,7 @@ func TestPlanTeamsPlansAnUnNesting(t *testing.T) {
 func TestPlanTeamsLeavesMatchingNestingAlone(t *testing.T) {
 	cfg := hierarchyCfg(config.TeamConfig{Name: "Oncall", Slug: "oncall", Parents: []string{"Platform"}})
 	st := &State{Org: "myorg", ActualTeams: []*github.Team{
-		{Slug: github.Ptr("oncall"), Parent: &github.Team{Slug: github.Ptr("platform")}},
+		{Slug: new("oncall"), Parent: &github.Team{Slug: new("platform")}},
 	}}
 
 	changes, _, err := planTeams(context.Background(), nil, cfg, st)
diff --git a/internal/sync/repo_plan.go b/internal/sync/repo_plan.go
index c9a8c0d..62cacb3 100644
--- a/internal/sync/repo_plan.go
+++ b/internal/sync/repo_plan.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/repo_settings.go b/internal/sync/repo_settings.go
index 6807b53..582c10b 100644
--- a/internal/sync/repo_settings.go
+++ b/internal/sync/repo_settings.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -46,37 +46,37 @@ var settingFields = []settingField{
 		name:    "allow_auto_merge",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.AllowAutoMerge },
 		current: func(r *github.Repository) (bool, bool) { return known(r.AllowAutoMerge) },
-		apply:   func(r *github.Repository, v bool) { r.AllowAutoMerge = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.AllowAutoMerge = new(v) },
 	},
 	{
 		name:    "allow_squash_merge",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.AllowSquashMerge },
 		current: func(r *github.Repository) (bool, bool) { return known(r.AllowSquashMerge) },
-		apply:   func(r *github.Repository, v bool) { r.AllowSquashMerge = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.AllowSquashMerge = new(v) },
 	},
 	{
 		name:    "allow_merge_commit",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.AllowMergeCommit },
 		current: func(r *github.Repository) (bool, bool) { return known(r.AllowMergeCommit) },
-		apply:   func(r *github.Repository, v bool) { r.AllowMergeCommit = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.AllowMergeCommit = new(v) },
 	},
 	{
 		name:    "allow_rebase_merge",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.AllowRebaseMerge },
 		current: func(r *github.Repository) (bool, bool) { return known(r.AllowRebaseMerge) },
-		apply:   func(r *github.Repository, v bool) { r.AllowRebaseMerge = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.AllowRebaseMerge = new(v) },
 	},
 	{
 		name:    "delete_branch_on_merge",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.DeleteBranchOnMerge },
 		current: func(r *github.Repository) (bool, bool) { return known(r.DeleteBranchOnMerge) },
-		apply:   func(r *github.Repository, v bool) { r.DeleteBranchOnMerge = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.DeleteBranchOnMerge = new(v) },
 	},
 	{
 		name:    "allow_update_branch",
 		want:    func(c config.RepoSettingsConfig) *bool { return c.AllowUpdateBranch },
 		current: func(r *github.Repository) (bool, bool) { return known(r.AllowUpdateBranch) },
-		apply:   func(r *github.Repository, v bool) { r.AllowUpdateBranch = github.Ptr(v) },
+		apply:   func(r *github.Repository, v bool) { r.AllowUpdateBranch = new(v) },
 	},
 }
 
@@ -303,7 +303,7 @@ func applyRepoVisibilityEnsure(ctx context.Context, c *gh.Client, ch util.Change
 	want := detailString(d, "visibility")
 
 	updated, _, err := c.REST.Repositories.Edit(ctx, org, repo, &github.Repository{
-		Visibility: github.Ptr(want),
+		Visibility: new(want),
 	})
 	if err != nil {
 		return fmt.Errorf("change visibility of %s/%s to %s: %w", org, repo, want, err)
diff --git a/internal/sync/repo_settings_test.go b/internal/sync/repo_settings_test.go
index 45bf6ae..ea89981 100644
--- a/internal/sync/repo_settings_test.go
+++ b/internal/sync/repo_settings_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 	"gopkg.in/yaml.v3"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
@@ -18,12 +18,12 @@ import (
 
 func repoWith(name string, autoMerge, mergeCommit, deleteBranch bool) *github.Repository {
 	return &github.Repository{
-		Name:                github.Ptr(name),
-		AllowAutoMerge:      github.Ptr(autoMerge),
-		AllowMergeCommit:    github.Ptr(mergeCommit),
-		DeleteBranchOnMerge: github.Ptr(deleteBranch),
-		AllowSquashMerge:    github.Ptr(true),
-		Visibility:          github.Ptr("private"),
+		Name:                new(name),
+		AllowAutoMerge:      new(autoMerge),
+		AllowMergeCommit:    new(mergeCommit),
+		DeleteBranchOnMerge: new(deleteBranch),
+		AllowSquashMerge:    new(true),
+		Visibility:          new("private"),
 	}
 }
 
@@ -95,7 +95,7 @@ func TestPlanRepoSettingsRepoOverridesOrgDefault(t *testing.T) {
 func TestPlanRepoSettingsSkipsWhatItCannotTouch(t *testing.T) {
 	cfg := cfgWithDefaults(houseStyle)
 	archived := repoWith("frozen", false, true, false)
-	archived.Archived = github.Ptr(true)
+	archived.Archived = new(true)
 	bySettings := map[string]repoSettings{"frozen": {}, "brand-new": {}}
 	existing := map[string]*github.Repository{"frozen": archived}
 
diff --git a/internal/sync/rulesets.go b/internal/sync/rulesets.go
index 8b2fa21..c5fc97b 100644
--- a/internal/sync/rulesets.go
+++ b/internal/sync/rulesets.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -375,10 +375,10 @@ func buildRules(ctx context.Context, r config.RulesetRules, l *refLookup) (*gith
 				entry.RepositoryID = &id
 			}
 			if w.Ref != "" {
-				entry.Ref = github.Ptr(w.Ref)
+				entry.Ref = new(w.Ref)
 			}
 			if w.SHA != "" {
-				entry.SHA = github.Ptr(w.SHA)
+				entry.SHA = new(w.SHA)
 			}
 			params.Workflows = append(params.Workflows, entry)
 		}
@@ -427,7 +427,7 @@ func buildPattern(p *config.PatternRule) *github.PatternRuleParameters {
 		Negate:   p.Negate,
 	}
 	if p.Name != "" {
-		params.Name = github.Ptr(p.Name)
+		params.Name = new(p.Name)
 	}
 	return params
 }
diff --git a/internal/sync/rulesets_apply.go b/internal/sync/rulesets_apply.go
index f2ea082..ccb62e7 100644
--- a/internal/sync/rulesets_apply.go
+++ b/internal/sync/rulesets_apply.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/gh"
 	"github.com/DragonSecurity/gomgr/internal/util"
diff --git a/internal/sync/rulesets_diff.go b/internal/sync/rulesets_diff.go
index 6d4d343..1301e9a 100644
--- a/internal/sync/rulesets_diff.go
+++ b/internal/sync/rulesets_diff.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 )
 
 // rulesetMatches reports whether the ruleset already on GitHub enforces exactly
diff --git a/internal/sync/rulesets_import.go b/internal/sync/rulesets_import.go
index 574d3bd..ebb3d9e 100644
--- a/internal/sync/rulesets_import.go
+++ b/internal/sync/rulesets_import.go
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/rulesets_import_test.go b/internal/sync/rulesets_import_test.go
index 4d0b4b3..e24f369 100644
--- a/internal/sync/rulesets_import_test.go
+++ b/internal/sync/rulesets_import_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 )
@@ -74,12 +74,12 @@ func TestImportedConfigReproducesTheRuleset(t *testing.T) {
 		Enforcement: github.RulesetEnforcementActive,
 		BypassActors: []*github.BypassActor{
 			{
-				ActorID:    github.Ptr(int64(77)),
+				ActorID:    new(int64(77)),
 				ActorType:  ptrTo(github.BypassActorTypeTeam),
 				BypassMode: ptrTo(github.BypassModePullRequest),
 			},
 			{
-				ActorID:    github.Ptr(int64(4242)),
+				ActorID:    new(int64(4242)),
 				ActorType:  ptrTo(github.BypassActorTypeIntegration),
 				BypassMode: ptrTo(github.BypassModeAlways),
 			},
@@ -177,9 +177,9 @@ func TestImportKeepsUnknownActorIDs(t *testing.T) {
 		Target:      ptrTo(github.RulesetTargetBranch),
 		Enforcement: github.RulesetEnforcementActive,
 		BypassActors: []*github.BypassActor{
-			{ActorID: github.Ptr(int64(999)), ActorType: ptrTo(github.BypassActorTypeTeam), BypassMode: ptrTo(github.BypassModeAlways)},
-			{ActorID: github.Ptr(int64(5)), ActorType: ptrTo(github.BypassActorTypeRepositoryRole), BypassMode: ptrTo(github.BypassModeAlways)},
-			{ActorID: github.Ptr(int64(1)), ActorType: ptrTo(github.BypassActorTypeOrganizationAdmin), BypassMode: ptrTo(github.BypassModeAlways)},
+			{ActorID: new(int64(999)), ActorType: ptrTo(github.BypassActorTypeTeam), BypassMode: ptrTo(github.BypassModeAlways)},
+			{ActorID: new(int64(5)), ActorType: ptrTo(github.BypassActorTypeRepositoryRole), BypassMode: ptrTo(github.BypassModeAlways)},
+			{ActorID: new(int64(1)), ActorType: ptrTo(github.BypassActorTypeOrganizationAdmin), BypassMode: ptrTo(github.BypassModeAlways)},
 		},
 		Rules: &github.RepositoryRulesetRules{NonFastForward: &github.EmptyRuleParameters{}},
 	}
@@ -205,11 +205,11 @@ func TestImportDropsGitHubSuppliedFalses(t *testing.T) {
 			CommitMessagePattern: &github.PatternRuleParameters{
 				Operator: github.PatternRuleOperatorContains,
 				Pattern:  "Signed-off-by:",
-				Negate:   github.Ptr(false),
+				Negate:   new(false),
 			},
 			RequiredStatusChecks: &github.RequiredStatusChecksRuleParameters{
 				RequiredStatusChecks: []*github.RuleStatusCheck{{Context: "build"}},
-				DoNotEnforceOnCreate: github.Ptr(false),
+				DoNotEnforceOnCreate: new(false),
 			},
 		},
 	}
diff --git a/internal/sync/rulesets_plan.go b/internal/sync/rulesets_plan.go
index b2071c9..4624314 100644
--- a/internal/sync/rulesets_plan.go
+++ b/internal/sync/rulesets_plan.go
@@ -8,7 +8,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -343,7 +343,7 @@ func fetchOrgRulesets(ctx context.Context, c *gh.Client, org string) ([]*github.
 // inherited from the organization, and expands each one.
 func fetchRepoRulesets(ctx context.Context, c *gh.Client, org, repo string) ([]*github.RepositoryRuleset, error) {
 	var summaries []*github.RepositoryRuleset
-	listOpts := &github.RepositoryListRulesetsOptions{IncludesParents: github.Ptr(false)}
+	listOpts := &github.RepositoryListRulesetsOptions{IncludesParents: new(false)}
 	if err := paginate(func(opts *github.ListOptions) (*github.Response, error) {
 		listOpts.ListOptions = *opts
 		page, resp, err := c.REST.Repositories.GetAllRulesets(ctx, org, repo, listOpts)
diff --git a/internal/sync/rulesets_test.go b/internal/sync/rulesets_test.go
index 6de02c9..0cca17f 100644
--- a/internal/sync/rulesets_test.go
+++ b/internal/sync/rulesets_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
@@ -395,12 +395,12 @@ func TestPlanRulesetSetCreatesUpdatesAndSkips(t *testing.T) {
 
 func TestPlanRulesetCleanup(t *testing.T) {
 	orgOwned := &github.RepositoryRuleset{
-		ID:         github.Ptr(int64(7)),
+		ID:         new(int64(7)),
 		Name:       "legacy",
 		SourceType: ptrTo(github.RulesetSourceTypeOrganization),
 	}
 	inherited := &github.RepositoryRuleset{
-		ID:         github.Ptr(int64(8)),
+		ID:         new(int64(8)),
 		Name:       "enterprise-wide",
 		SourceType: ptrTo(github.RulesetSourceTypeEnterprise),
 	}
diff --git a/internal/sync/rulesets_unmodeled.go b/internal/sync/rulesets_unmodeled.go
index 51b8db4..ac85220 100644
--- a/internal/sync/rulesets_unmodeled.go
+++ b/internal/sync/rulesets_unmodeled.go
@@ -5,7 +5,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 )
 
 // modeledRuleFields are the fields of github.RepositoryRulesetRules that
diff --git a/internal/sync/rulesets_unmodeled_test.go b/internal/sync/rulesets_unmodeled_test.go
index 4d97661..bb1aecd 100644
--- a/internal/sync/rulesets_unmodeled_test.go
+++ b/internal/sync/rulesets_unmodeled_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 )
 
 // The whole point of the modeled set is that it cannot fall behind go-github.
diff --git a/internal/sync/state_cache.go b/internal/sync/state_cache.go
index 2832722..e69c1e4 100644
--- a/internal/sync/state_cache.go
+++ b/internal/sync/state_cache.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/gh"
 )
diff --git a/internal/sync/teams.go b/internal/sync/teams.go
index f4c620b..e610218 100644
--- a/internal/sync/teams.go
+++ b/internal/sync/teams.go
@@ -10,7 +10,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/teams_import.go b/internal/sync/teams_import.go
index ee111bc..9c5e309 100644
--- a/internal/sync/teams_import.go
+++ b/internal/sync/teams_import.go
@@ -8,7 +8,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/gh"
diff --git a/internal/sync/teams_test.go b/internal/sync/teams_test.go
index 1ce31f0..bd63708 100644
--- a/internal/sync/teams_test.go
+++ b/internal/sync/teams_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/go-github/v90/github"
+	"github.com/google/go-github/v91/github"
 
 	"github.com/DragonSecurity/gomgr/internal/config"
 	"github.com/DragonSecurity/gomgr/internal/util"
@@ -754,8 +754,8 @@ func TestPlanTeams(t *testing.T) {
 	st := &State{
 		Org: "myorg",
 		ActualTeams: []*github.Team{
-			{ID: github.Ptr(int64(1)), Slug: github.Ptr("backend"), Name: github.Ptr("Backend"), Description: github.Ptr("Backend team"), Privacy: github.Ptr("closed")},
-			{ID: github.Ptr(int64(2)), Slug: github.Ptr("frontend"), Name: github.Ptr("Frontend"), Description: github.Ptr("Old desc"), Privacy: github.Ptr("closed")},
+			{ID: new(int64(1)), Slug: new("backend"), Name: new("Backend"), Description: new("Backend team"), Privacy: new("closed")},
+			{ID: new(int64(2)), Slug: new("frontend"), Name: new("Frontend"), Description: new("Old desc"), Privacy: new("closed")},
 		},
 	}
 
@@ -871,7 +871,7 @@ func TestPlanRepoPerms(t *testing.T) {
 	st := &State{
 		Org: "myorg",
 		ActualRepos: []*github.Repository{
-			{Name: github.Ptr("api"), Topics: []string{"backend"}},
+			{Name: new("api"), Topics: []string{"backend"}},
 		},
 	}
 
@@ -917,12 +917,12 @@ func TestPlanCleanups(t *testing.T) {
 		Org:          "myorg",
 		ManagedRepos: map[string]bool{"api": true},
 		ActualTeams: []*github.Team{
-			{ID: github.Ptr(int64(1)), Slug: github.Ptr("backend")},
-			{ID: github.Ptr(int64(2)), Slug: github.Ptr("old-team")},
+			{ID: new(int64(1)), Slug: new("backend")},
+			{ID: new(int64(2)), Slug: new("old-team")},
 		},
 		ActualRepos: []*github.Repository{
-			{Name: github.Ptr("api")},
-			{Name: github.Ptr("legacy-app")},
+			{Name: new("api")},
+			{Name: new("legacy-app")},
 		},
 	}
 
@@ -1456,9 +1456,9 @@ func TestPlanTeams_NotificationSetting(t *testing.T) {
 	st := &State{
 		Org: "myorg",
 		ActualTeams: []*github.Team{
-			{Slug: github.Ptr("agrees"), Name: github.Ptr("Agrees"), NotificationSetting: github.Ptr(config.NotificationsDisabled)},
-			{Slug: github.Ptr("differs"), Name: github.Ptr("Differs"), NotificationSetting: github.Ptr(config.NotificationsEnabled)},
-			{Slug: github.Ptr("silent"), Name: github.Ptr("Silent"), NotificationSetting: github.Ptr(config.NotificationsEnabled)},
+			{Slug: new("agrees"), Name: new("Agrees"), NotificationSetting: new(config.NotificationsDisabled)},
+			{Slug: new("differs"), Name: new("Differs"), NotificationSetting: new(config.NotificationsEnabled)},
+			{Slug: new("silent"), Name: new("Silent"), NotificationSetting: new(config.NotificationsEnabled)},
 		},
 	}