diff --git a/.github/workflows/args.yaml b/.github/workflows/args.yaml
index bef26b64..c254c7e4 100644
--- a/.github/workflows/args.yaml
+++ b/.github/workflows/args.yaml
@@ -1,4 +1,5 @@
 name: package:args
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/args/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/async.yaml b/.github/workflows/async.yaml
index e086f23c..99fd177c 100644
--- a/.github/workflows/async.yaml
+++ b/.github/workflows/async.yaml
@@ -1,4 +1,5 @@
 name: package:async
+permissions: read-all
 
 on:
   # Run on PRs and pushes to the default branch.
@@ -15,9 +16,6 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
-env:
-  PUB_ENVIRONMENT: bot.github
-
 defaults:
   run:
     working-directory: pkgs/async/
diff --git a/.github/workflows/characters.yaml b/.github/workflows/characters.yaml
index bb0c5f16..d7959eb7 100644
--- a/.github/workflows/characters.yaml
+++ b/.github/workflows/characters.yaml
@@ -1,4 +1,5 @@
 name: package:characters
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/characters/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/collection.yaml b/.github/workflows/collection.yaml
index 247d91f6..f3fd7610 100644
--- a/.github/workflows/collection.yaml
+++ b/.github/workflows/collection.yaml
@@ -1,4 +1,5 @@
 name: package:collection
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -15,9 +16,6 @@ on:
   schedule:
     - cron: "0 0 * * 0"
 
-env:
-  PUB_ENVIRONMENT: bot.github
-
 defaults:
   run:
     working-directory: pkgs/collection/
diff --git a/.github/workflows/convert.yaml b/.github/workflows/convert.yaml
index 1dad9642..4ec82862 100644
--- a/.github/workflows/convert.yaml
+++ b/.github/workflows/convert.yaml
@@ -1,4 +1,5 @@
 name: package:convert
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/convert/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/crypto.yaml b/.github/workflows/crypto.yaml
index f381f314..f4fe9441 100644
--- a/.github/workflows/crypto.yaml
+++ b/.github/workflows/crypto.yaml
@@ -1,4 +1,5 @@
 name: package:crypto
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/crypto/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/fixnum.yaml b/.github/workflows/fixnum.yaml
index 06befb23..fb3db080 100644
--- a/.github/workflows/fixnum.yaml
+++ b/.github/workflows/fixnum.yaml
@@ -1,4 +1,5 @@
 name: package:fixnum
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/fixnum/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/lints.yaml b/.github/workflows/lints.yaml
index c64ab413..9135065d 100644
--- a/.github/workflows/lints.yaml
+++ b/.github/workflows/lints.yaml
@@ -1,4 +1,5 @@
 name: package:lints
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/lints/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/logging.yaml b/.github/workflows/logging.yaml
index ee669151..0bf08a83 100644
--- a/.github/workflows/logging.yaml
+++ b/.github/workflows/logging.yaml
@@ -1,4 +1,5 @@
 name: package:logging
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/logging/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/os_detect.yaml b/.github/workflows/os_detect.yaml
index 5405e336..637e4833 100644
--- a/.github/workflows/os_detect.yaml
+++ b/.github/workflows/os_detect.yaml
@@ -1,4 +1,5 @@
 name: package:os_detect
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/os_detect/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/path.yaml b/.github/workflows/path.yaml
index c35e02c5..87f72b39 100644
--- a/.github/workflows/path.yaml
+++ b/.github/workflows/path.yaml
@@ -1,4 +1,5 @@
 name: package:path
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/path/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/platform.yaml b/.github/workflows/platform.yaml
index 981c4636..5cc9e0b3 100644
--- a/.github/workflows/platform.yaml
+++ b/.github/workflows/platform.yaml
@@ -1,4 +1,5 @@
 name: package:platform
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/platform/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run:
diff --git a/.github/workflows/typed_data.yaml b/.github/workflows/typed_data.yaml
index 2ea36f70..d3982691 100644
--- a/.github/workflows/typed_data.yaml
+++ b/.github/workflows/typed_data.yaml
@@ -1,4 +1,5 @@
 name: package:typed_data
+permissions: read-all
 
 on:
   # Run CI on pushes to the main branch, and on PRs against main.
@@ -14,8 +15,6 @@ on:
       - 'pkgs/typed_data/**'
   schedule:
     - cron: "0 0 * * 0"
-env:
-  PUB_ENVIRONMENT: bot.github
 
 defaults:
   run: