diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7c8efa46a..d3dd8bb49 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
 permissions:
   contents: read
+  packages: read
   pull-requests: read
   # Required for Sentry to associate commits with releases
   actions: read
@@ -24,6 +25,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4f320ec2b..9acc80533 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:
@@ -79,6 +80,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -110,6 +112,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/e2e-reusable.yml b/.github/workflows/e2e-reusable.yml
index 87f4796ab..26bfb0da2 100644
--- a/.github/workflows/e2e-reusable.yml
+++ b/.github/workflows/e2e-reusable.yml
@@ -57,6 +57,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   # Smoke/mega-flow gate for PR/push (full=false). The full-suite path lives in
@@ -76,6 +77,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Cache pnpm store
@@ -386,6 +388,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Cache pnpm store
@@ -429,6 +432,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Install pnpm
@@ -527,6 +531,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
 
       - name: Install pnpm
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 8015e035f..1e40f1e2c 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -31,6 +31,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:
diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml
index 3099f524f..061ea5615 100644
--- a/.github/workflows/pr-quality.yml
+++ b/.github/workflows/pr-quality.yml
@@ -5,6 +5,7 @@ on:
     types: [opened, synchronize, reopened, labeled, unlabeled, edited]
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref || github.ref }}
diff --git a/.github/workflows/test-reusable.yml b/.github/workflows/test-reusable.yml
index 2d3919380..a083a09c9 100644
--- a/.github/workflows/test-reusable.yml
+++ b/.github/workflows/test-reusable.yml
@@ -34,6 +34,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
 
 jobs:
   i18n-coverage:
@@ -110,6 +111,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -137,6 +139,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
@@ -169,6 +172,7 @@ jobs:
           ref: ${{ inputs.ref }}
           fetch-depth: 1
           # Required for app/src-tauri/vendor/tauri-cef.
+          persist-credentials: false
           submodules: recursive
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 56e5fdc1d..71e8c4cd1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,6 +13,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 
 concurrency:
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index fc38a1b79..dcc0344bd 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -6,6 +6,7 @@ on:
   pull_request:
 permissions:
   contents: read
+  packages: read
   pull-requests: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref