diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 966da0bc..c2094a6f 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -4,8 +4,9 @@ on:
   schedule:
     - cron: '0 13 * * 1' # At 1:00 PM UTC every Monday
   pull_request:
-    paths:
-      - '.github/workflows/codeql.yaml'
+    branches:
+      - "main"
+      - "release/**"
 
 jobs:
   analyze:
diff --git a/.github/workflows/deliver.yaml b/.github/workflows/deliver.yaml
index 4b1447ec..456f4c9a 100644
--- a/.github/workflows/deliver.yaml
+++ b/.github/workflows/deliver.yaml
@@ -16,7 +16,7 @@ jobs:
   deliver:
     permissions:
       contents: write
-      packages: write
+      packages: read
     uses: opentdf/web-sdk/.github/workflows/reusable_deliver.yaml@main
     secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}