diff --git a/.github/workflows/cli-npm-publish.yml b/.github/workflows/cli-npm-publish.yml
index d01e9ad0..cd03f539 100644
--- a/.github/workflows/cli-npm-publish.yml
+++ b/.github/workflows/cli-npm-publish.yml
@@ -8,11 +8,15 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   compute-staging-version:
     # Only run for manual dispatch (staging)
     if: github.event_name == 'workflow_dispatch'
     uses: ./.github/workflows/reusable-compute-staging-version.yml
+    permissions:
+      contents: read
     with:
       working-directory: cli
 
@@ -20,6 +24,10 @@ jobs:
     # Only run for manual dispatch (staging)
     if: github.event_name == 'workflow_dispatch'
     uses: ./.github/workflows/reusable-cli-npm.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     needs: compute-staging-version
     with:
       version: ${{ needs.compute-staging-version.outputs.version }}
@@ -30,5 +38,9 @@ jobs:
     if:
       ${{ github.event_name == 'release' && startsWith(github.ref_name,'iapp-v') }}
     uses: ./.github/workflows/reusable-cli-npm.yml
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     with:
       tag: 'latest'
diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index f63de681..4a78f1c5 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -3,6 +3,8 @@ on:
   pull_request:
     paths: ['cli/**']
 
+permissions: {}
+
 concurrency:
   group: ${{ github.ref }}-cli-pr-checks
   cancel-in-progress: true
@@ -10,12 +12,16 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -50,5 +56,10 @@ jobs:
 
   npm-dry-run:
     uses: ./.github/workflows/reusable-cli-npm.yml
+    # publish-npm requests these permissions statically, even in dry-run
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     with:
       dry-run: true
diff --git a/.github/workflows/conventional-commit-check-commits.yml b/.github/workflows/conventional-commit-check-commits.yml
deleted file mode 100644
index 11b58acc..00000000
--- a/.github/workflows/conventional-commit-check-commits.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Conventional Commit Check Commits
-description: checks every commit in the PR respects the conventional commit
-
-on: [pull_request]
-
-jobs:
-  check-conventional-commits:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Check Commit Conventions
-        uses: webiny/action-conventional-commits@v1.3.0
diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index 28a18f2a..d5d2e61a 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -1,15 +1,16 @@
+# checks the PR title respects the conventional commit
 name: Conventional Commit Check PR Title
-description: checks the PR title respects the conventional commit
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - reopened
+      - synchronize
 
 jobs:
   lint-pr-title:
     permissions:
       pull-requests: read
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@conventional-commits-v1.1.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@080cd7070517853f1a1352855a6f47fa1725f08f # conventional-commits-v1.2.2
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 183dfd79..8124e4fc 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -1,17 +1,16 @@
+# triggers release-please to open the next release PR
 name: release-please
-description: triggers release-please to open the next release PR
 
 on:
   push:
     branches:
       - main
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@release-please-v2.1.0
-    secrets: inherit
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@31ad5d9e686d47c7ebdd3c7df3f8c50f58415428 # release-please-v2.2.3
+    secrets:
+      RELEASE_PLEASE_APPLICATION_ID: ${{ secrets.RELEASE_PLEASE_APPLICATION_ID }}
+      RELEASE_PLEASE_PRIVATE_KEY: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }}
diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index 8e9d339a..eb3d1022 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -1,5 +1,5 @@
+# reusable npm workflow for this project
 name: npm publish
-description: reusable npm workflow for this project
 
 on:
   workflow_call:
@@ -20,7 +20,7 @@ on:
 
 jobs:
   npm-publish:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@publish-npm-v1.6.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@c180a865f53d525d94e5ea7662892e60d66369f3 # publish-npm-v2.0.0
     with:
       working-directory: cli
       install-command: npm ci
@@ -28,5 +28,5 @@ jobs:
       dry-run: ${{ inputs.dry-run }}
       tag: ${{ inputs.tag }}
       version: ${{ inputs.version }}
-      environment: ${{ (inputs.dry-run && '') || inputs.tag }}
+      environment: ${{ (!inputs.dry-run && inputs.tag) || '' }}
       provenance: ${{ !inputs.dry-run }}
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index 740cecc7..86f1c8fd 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -1,6 +1,5 @@
+# compute a staging version from the current version, branch name and commit
 name: Compute staging version
-description:
-  compute a staging version from the current version, branch name and commit
 
 on:
   workflow_call:
@@ -19,21 +18,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
       - name: Set publish version
         id: set-publish-version
         working-directory: ${{ inputs.working-directory }}
         run: |
-          BRANCH=$(echo "${{ github.ref_name }}" | sed 's|/|-|g')
-          COMMIT_SHA="${{ github.sha }}"
+          BRANCH="${GITHUB_REF_NAME//\//-}"
+          COMMIT_SHA="${GITHUB_SHA}"
           CURRENT_VERSION=$(npm pkg get version | tr -d '"')
           STAGING_VERSION="${CURRENT_VERSION}-${BRANCH}-${COMMIT_SHA::7}"
-          echo "VERSION=${STAGING_VERSION}" | tee -a $GITHUB_OUTPUT
-          echo "DIST_TAG=${BRANCH}" | tee -a $GITHUB_OUTPUT
+          echo "VERSION=${STAGING_VERSION}" | tee -a "$GITHUB_OUTPUT"
+          echo "DIST_TAG=${BRANCH}" | tee -a "$GITHUB_OUTPUT"
     outputs:
       version: ${{ steps.set-publish-version.outputs.VERSION }}
       dist-tag: ${{ steps.set-publish-version.outputs.DIST_TAG }}