diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 1fb0bd7..2361a69 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -23,7 +23,7 @@ jobs:
           - { os: ubuntu-latest, version: 'nightly', arch: x64}
           - { os: ubuntu-latest, version: '1', arch: x86 }
           - { os: windows-latest, version: '1', arch: x64}
-          - { os: macOS-latest, version: '1', arch: x64}
+          - { os: macOS-latest, version: '1', arch: aarch64}
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/TagBot.yml b/.github/workflows/TagBot.yml
index f49313b..f1501fa 100644
--- a/.github/workflows/TagBot.yml
+++ b/.github/workflows/TagBot.yml
@@ -4,6 +4,24 @@ on:
     types:
       - created
   workflow_dispatch:
+    inputs:
+      lookback:
+        default: "3"
+
+permissions:
+  actions: read
+  checks: read
+  contents: write
+  deployments: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   TagBot:
     if: github.event_name == 'workflow_dispatch' || github.actor == 'JuliaTagBot'
@@ -12,4 +30,3 @@ jobs:
       - uses: JuliaRegistries/TagBot@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          ssh: ${{ secrets.DOCUMENTER_KEY }}