diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml
index e880f1ac..78a294be 100644
--- a/.github/workflows/cpp-linter.yml
+++ b/.github/workflows/cpp-linter.yml
@@ -8,10 +8,13 @@ on:
     paths:
       - "docs/examples/demo/*"
 
+permissions: {}
 
 jobs:
   cpp-linter:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -28,7 +31,9 @@ jobs:
 
       - name: Fail fast?!
         if: steps.linter.outputs.checks-failed != 0
+        env:
+          CHECKS_FAILED: ${{ steps.linter.outputs.checks-failed }}
         run: |
-          echo "some linter checks failed. ${{ steps.linter.outputs.checks-failed }}"
+          echo "some linter checks failed. ${CHECKS_FAILED}"
         # for actual deployment
         # run: exit 1
diff --git a/.github/workflows/mkdocs-deploy.yml b/.github/workflows/mkdocs-deploy.yml
index 0f4fd2ab..73b37c65 100644
--- a/.github/workflows/mkdocs-deploy.yml
+++ b/.github/workflows/mkdocs-deploy.yml
@@ -7,6 +7,13 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build-docs:
+    permissions:
+      contents: read
+      # to deploy to Pages (only on the main branch)
+      pages: write
+      id-token: write
     uses: cpp-linter/.github/.github/workflows/mkdocs.yml@main
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 3509b4b4..104ce5b9 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+permissions: {}
+
 jobs:
   pre-commit:
+    permissions:
+      contents: read
     uses: cpp-linter/.github/.github/workflows/pre-commit.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 62f9f364..7b224df2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,8 +32,10 @@ jobs:
         git config user.name 'github-actions'
         git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
     - name: Update rolling tag
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
       run: |
-        # Get the major version from the latest tag
-        MAJOR_VERSION=`git tag --list --sort=-v:refname | head -n1 | cut -d. -f1`
-        git tag --force --annotate ${{ inputs.tag || '$MAJOR_VERSION' }} --message 'Retag ${{ inputs.tag || '$MAJOR_VERSION' }}'
-        git push origin ${{ inputs.tag || '$MAJOR_VERSION' }} --force
+        # Use the tag given by hand, else the major version of the latest tag
+        TAG="${INPUT_TAG:-$(git tag --list --sort=-v:refname | head -n1 | cut -d. -f1)}"
+        git tag --force --annotate "$TAG" --message "Retag $TAG"
+        git push origin "$TAG" --force