diff --git a/.github/workflows/sync-common-workflows.yaml b/.github/workflows/sync-common-workflows.yaml
index 9b28d66..a03e3b9 100644
--- a/.github/workflows/sync-common-workflows.yaml
+++ b/.github/workflows/sync-common-workflows.yaml
@@ -45,6 +45,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: workflows
+          persist-credentials: false
+
       - name: Sync Workflows
         run: |
           git config --global user.email "shaka-bot@users.noreply.github.com"
diff --git a/.github/workflows/sync-labels.yaml b/.github/workflows/sync-labels.yaml
index ac1b6ca..9dc6183 100644
--- a/.github/workflows/sync-labels.yaml
+++ b/.github/workflows/sync-labels.yaml
@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       # TODO: revert to micnncim and new release after landing
       #       https://github.com/micnncim/action-label-syncer/pull/68
diff --git a/.github/workflows/test-update-issues.yaml b/.github/workflows/test-update-issues.yaml
index afa6fd9..90c6f24 100644
--- a/.github/workflows/test-update-issues.yaml
+++ b/.github/workflows/test-update-issues.yaml
@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref || github.ref }}
+          persist-credentials: false
 
       - name: Test
         run: |
diff --git a/.github/workflows/update-issues.yaml b/.github/workflows/update-issues.yaml
index 29b6984..7fc25cf 100644
--- a/.github/workflows/update-issues.yaml
+++ b/.github/workflows/update-issues.yaml
@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       - name: Update Issues
         env:
diff --git a/compute-sha/README.md b/compute-sha/README.md
index 625b85b..5af76a4 100644
--- a/compute-sha/README.md
+++ b/compute-sha/README.md
@@ -30,6 +30,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.compute-sha.outputs.SHA }}
+          persist-credentials: false
 
       # ...
 ```
diff --git a/sync-labels/sync-labels.yaml b/sync-labels/sync-labels.yaml
index ac1b6ca..9dc6183 100644
--- a/sync-labels/sync-labels.yaml
+++ b/sync-labels/sync-labels.yaml
@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       # TODO: revert to micnncim and new release after landing
       #       https://github.com/micnncim/action-label-syncer/pull/68
diff --git a/update-issues/update-issues.yaml b/update-issues/update-issues.yaml
index 29b6984..7fc25cf 100644
--- a/update-issues/update-issues.yaml
+++ b/update-issues/update-issues.yaml
@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: shaka-project/shaka-github-tools
+          persist-credentials: false
 
       - name: Update Issues
         env: