diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 13d0256..f67fe8c 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - "v*"
+permissions: {}
 jobs:
   test:
     name: Test
@@ -14,6 +15,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3772740..956a402 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,12 +14,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
         with:
-          path: |
-            ./__pypackages__
-          key: ${{ runner.os }}-python-${{ hashFiles('**/pdm.lock') }}
+          persist-credentials: false
 
       - name: Install dependencies
         run: ./pw pdm install -G :all