diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 59eec38..bf31623 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -32,7 +32,10 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Install tomato-toml
-        run: cargo install tomato-toml --locked
+        uses: baptiste0928/cargo-install@b687c656bda5733207e629b50a22bf68974a0305 # v3.3.2
+        with:
+          crate: tomato-toml
+          locked: true
 
       - name: Calculate next version
         id: version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2348848..b89ffe3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,3 +56,6 @@ jobs:
       bump: patch
     secrets:
       PLOTNIK_PAT: ${{ secrets.PLOTNIK_PAT }}
+    permissions:
+      contents: write
+      pull-requests: write