diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml
index c8a16a9a..48f01837 100644
--- a/.github/workflows/example.yml
+++ b/.github/workflows/example.yml
@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   cloudquery-sync:
     permissions:
@@ -15,8 +18,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        dbversion: ['postgres:latest']
-        cloudquery-version: ['6.8.0', 'v6.8.0']
+        dbversion: ["postgres:latest"]
+        cloudquery-version: ["6.8.0", "v6.8.0"]
         os: [ubuntu-latest]
       fail-fast: false
     services:
diff --git a/.github/workflows/example_matrix.yml b/.github/workflows/example_matrix.yml
index 293a6014..6922147d 100644
--- a/.github/workflows/example_matrix.yml
+++ b/.github/workflows/example_matrix.yml
@@ -5,6 +5,8 @@ on:
       - main
   pull_request:
     types: [opened, synchronize, reopened]
+permissions:
+  contents: read
 jobs:
   cloudquery:
     permissions:
@@ -39,7 +41,7 @@ jobs:
       - name: Setup CloudQuery
         uses: ./.
         with:
-          version: 'v6.8.0'
+          version: "v6.8.0"
       - name: Sync with CloudQuery
         run: cloudquery sync example_configs/spec.yml --log-console --shard ${{ matrix.shard }}
         env:
diff --git a/.github/workflows/prepare.yml b/.github/workflows/prepare.yml
index c80d522c..55dcedef 100644
--- a/.github/workflows/prepare.yml
+++ b/.github/workflows/prepare.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - release-*
+permissions:
+  contents: read
+
 jobs:
   prepare-dist:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
           token: ${{ secrets.GH_CQ_BOT }}
       - uses: actions/setup-node@v4
         with:
-          node-version: 'lts/*'
-          cache: 'npm'
+          node-version: "lts/*"
+          cache: "npm"
       - name: Install dependencies
         run: npm ci
       - uses: stefanzweifel/git-auto-commit-action@v5
         with:
-          commit_message: 'chore: Prepare dist'
+          commit_message: "chore: Prepare dist"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index fe674d1c..8d7f9fb0 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - main
+
+permissions:
+  contents: read
+
 jobs:
   release-please:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5fc19b7b..254af128 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -15,8 +18,8 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 'lts/*'
-          cache: 'npm'
+          node-version: "lts/*"
+          cache: "npm"
       - name: Install Dependencies
         run: npm ci
 
diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index 1d8ea8a5..1c7983a5 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -4,11 +4,14 @@ on:
   release:
     types: [published, edited]
 
+permissions:
+  contents: write
+
 jobs:
   actions-tagger:
     runs-on: ubuntu-latest
     steps:
-      - uses: Actions-R-Us/actions-tagger@latest
+      - uses: Actions-R-Us/actions-tagger@330ddfac760021349fef7ff62b372f2f691c20fb
         with:
           publish_latest_tag: true
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/dist/index.js b/dist/index.js
index 04a2bc81..660d27b9 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -14963,6 +14963,14 @@ function _supportsColor(haveStream, {streamIsTTY, sniffFlags = true} = {}) {
 		return 3;
 	}
 
+	if (env.TERM === 'xterm-ghostty') {
+		return 3;
+	}
+
+	if (env.TERM === 'wezterm') {
+		return 3;
+	}
+
 	if ('TERM_PROGRAM' in env) {
 		const version = Number.parseInt((env.TERM_PROGRAM_VERSION || '').split('.')[0], 10);