diff --git a/.github/workflows/check-dependencies.yml b/.github/workflows/check-dependencies.yml
index 1c7e00973e90..756cdc9c1044 100644
--- a/.github/workflows/check-dependencies.yml
+++ b/.github/workflows/check-dependencies.yml
@@ -22,6 +22,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup Node.js 22
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml
index 7d7300c30e21..ac9015c3f281 100644
--- a/.github/workflows/diff.yml
+++ b/.github/workflows/diff.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
-      contents: write
+      contents: read
       issues: write
       pull-requests: write
     steps:
@@ -26,6 +26,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index b707184b41e1..85d56a154a27 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: docs-pages
@@ -18,9 +16,13 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Configure Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
@@ -57,6 +59,9 @@ jobs:
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/.github/workflows/integration-test-Linux.yml b/.github/workflows/integration-test-Linux.yml
index 495647724833..025d8140a3e4 100644
--- a/.github/workflows/integration-test-Linux.yml
+++ b/.github/workflows/integration-test-Linux.yml
@@ -29,13 +29,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check skip CI
         run: echo "RESULT=$(node ./scripts/skipCI.js)" >> "$GITHUB_OUTPUT"
         id: skip-ci
 
       - name: Log skip CI result
-        run: echo "${{steps.skip-ci.outputs.RESULT}}"
+        env:
+          SKIP_CI_RESULT: ${{ steps.skip-ci.outputs.RESULT }}
+        run: echo "$SKIP_CI_RESULT"
 
       - name: Setup Node.js 26.x
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/integration-test-Windows.yml b/.github/workflows/integration-test-Windows.yml
index f2598c5e8c67..f31b5724addc 100644
--- a/.github/workflows/integration-test-Windows.yml
+++ b/.github/workflows/integration-test-Windows.yml
@@ -34,6 +34,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
@@ -46,7 +47,9 @@ jobs:
         id: skip-ci
 
       - name: Log skip CI result
-        run: echo "${{steps.skip-ci.outputs.RESULT}}"
+        env:
+          SKIP_CI_RESULT: ${{ steps.skip-ci.outputs.RESULT }}
+        run: echo "$env:SKIP_CI_RESULT"
 
       - name: Setup Node.js 26.x
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/lint-Linux.yml b/.github/workflows/lint-Linux.yml
index c7480b6c717f..701dab36bee4 100644
--- a/.github/workflows/lint-Linux.yml
+++ b/.github/workflows/lint-Linux.yml
@@ -30,7 +30,8 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # This makes Actions fetch only one branch to release
-            fetch-depth: 1
+          fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
diff --git a/.github/workflows/test-builder-e2e.yml b/.github/workflows/test-builder-e2e.yml
index 900ba4cdec8c..4125316c46d8 100644
--- a/.github/workflows/test-builder-e2e.yml
+++ b/.github/workflows/test-builder-e2e.yml
@@ -20,6 +20,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Nx Cache
         id: nx-cache
diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml
index b243cd8ff053..c44938b525a7 100644
--- a/.github/workflows/type-check.yml
+++ b/.github/workflows/type-check.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup Node.js 22
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -41,7 +42,9 @@ jobs:
         id: skip-ci
 
       - name: Log skip CI result
-        run: echo "${{steps.skip-ci.outputs.RESULT}}"
+        env:
+          SKIP_CI_RESULT: ${{ steps.skip-ci.outputs.RESULT }}
+        run: echo "$SKIP_CI_RESULT"
 
       - name: Nx Cache
         id: nx-cache
diff --git a/.github/workflows/ut-Windows.yml b/.github/workflows/ut-Windows.yml
index 3ea4591caa54..0d7688742970 100644
--- a/.github/workflows/ut-Windows.yml
+++ b/.github/workflows/ut-Windows.yml
@@ -30,6 +30,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
@@ -42,7 +43,9 @@ jobs:
         id: skip-ci
 
       - name: Log skip CI result
-        run: echo "${{steps.skip-ci.outputs.RESULT}}"
+        env:
+          SKIP_CI_RESULT: ${{ steps.skip-ci.outputs.RESULT }}
+        run: echo "$env:SKIP_CI_RESULT"
 
       - name: Setup Node.js 26.x
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/ut-macOS.yml b/.github/workflows/ut-macOS.yml
index 51f7f0ac5b66..d38feca57528 100644
--- a/.github/workflows/ut-macOS.yml
+++ b/.github/workflows/ut-macOS.yml
@@ -30,6 +30,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
@@ -41,7 +42,9 @@ jobs:
         id: skip-ci
 
       - name: Log skip CI result
-        run: echo "${{steps.skip-ci.outputs.RESULT}}"
+        env:
+          SKIP_CI_RESULT: ${{ steps.skip-ci.outputs.RESULT }}
+        run: echo "$SKIP_CI_RESULT"
 
       - name: Setup Node.js 26.x
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0