diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ae5329..ff65ba2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
   lint:
     timeout-minutes: 10
     name: lint
-    runs-on: ${{ github.repository == 'stainless-sdks/getimg-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ${{ github.repository == 'stainless-sdks/getimg-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -78,7 +78,7 @@ jobs:
   test:
     timeout-minutes: 10
     name: test
-    runs-on: ${{ github.repository == 'stainless-sdks/getimg-python' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index b06ba91..6b7b74c 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.2.1"
+  ".": "0.3.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b992454..1a15493 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.3.0 (2026-07-18)
+
+Full Changelog: [v0.2.1...v0.3.0](https://github.com/getimg-ai/getimg-python/compare/v0.2.1...v0.3.0)
+
+### Features
+
+* **stlc:** configurable CI runner and private-production-repo support in workflow templates ([9c2898e](https://github.com/getimg-ai/getimg-python/commit/9c2898ece0e514b12abfbac030e9fc415573040d))
+
+
+### Bug Fixes
+
+* **auth:** prioritize first auth header ([483db61](https://github.com/getimg-ai/getimg-python/commit/483db61cadf8e4f3b293365e133d76748f4b8bcf))
+* **internal:** resolve build failures ([d26ee9c](https://github.com/getimg-ai/getimg-python/commit/d26ee9cce58ff460065c7dce220814ea32b5c728))
+
 ## 0.2.1 (2026-05-13)
 
 Full Changelog: [v0.2.0...v0.2.1](https://github.com/getimg-ai/getimg-python/compare/v0.2.0...v0.2.1)
diff --git a/pyproject.toml b/pyproject.toml
index 8105d40..6dda264 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "getimg"
-version = "0.2.1"
+version = "0.3.0"
 description = "The official Python library for the getimg.ai API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/scripts/lint b/scripts/lint
index c30e5db..88654d9 100755
--- a/scripts/lint
+++ b/scripts/lint
@@ -13,7 +13,7 @@ else
 fi
 
 echo "==> Running pyright"
-uv run pyright
+uv run pyright -p .
 
 echo "==> Running mypy"
 uv run mypy .
diff --git a/src/getimg/_client.py b/src/getimg/_client.py
index ee3b133..bebb117 100644
--- a/src/getimg/_client.py
+++ b/src/getimg/_client.py
@@ -152,9 +152,11 @@ def qs(self) -> Querystring:
 
     @override
     def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:
-        return {
-            **(self._bearer_auth if security.get("bearer_auth", False) else {}),
-        }
+        headers: dict[str, str] = {}
+        if security.get("bearer_auth", False):
+            for key, value in self._bearer_auth.items():
+                headers.setdefault(key, value)
+        return headers
 
     @property
     def _bearer_auth(self) -> dict[str, str]:
@@ -354,9 +356,11 @@ def qs(self) -> Querystring:
 
     @override
     def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:
-        return {
-            **(self._bearer_auth if security.get("bearer_auth", False) else {}),
-        }
+        headers: dict[str, str] = {}
+        if security.get("bearer_auth", False):
+            for key, value in self._bearer_auth.items():
+                headers.setdefault(key, value)
+        return headers
 
     @property
     def _bearer_auth(self) -> dict[str, str]:
diff --git a/src/getimg/_version.py b/src/getimg/_version.py
index e5bf8ce..9dcc2db 100644
--- a/src/getimg/_version.py
+++ b/src/getimg/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "getimg"
-__version__ = "0.2.1"  # x-release-please-version
+__version__ = "0.3.0"  # x-release-please-version