diff --git a/.github/workflows/build-docker.yaml b/.github/workflows/build-docker.yaml
index 99f831cde2..1e36ceaad5 100644
--- a/.github/workflows/build-docker.yaml
+++ b/.github/workflows/build-docker.yaml
@@ -31,6 +31,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive
+          persist-credentials: false
 
       - name: Build
         shell: bash
diff --git a/.github/workflows/build-docs.yaml b/.github/workflows/build-docs.yaml
index 899f8da0f8..1037d78300 100644
--- a/.github/workflows/build-docs.yaml
+++ b/.github/workflows/build-docs.yaml
@@ -43,6 +43,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Generate docs
         run: |
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index df53eaea32..32a437b765 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -47,6 +47,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Configure Build Matrix
         id: configure
@@ -99,6 +100,7 @@ jobs:
           ref: ${{ inputs.ref }}
           submodules: recursive
           fetch-tags: true
+          persist-credentials: false
 
       - name: Install Linux deps
         if: runner.os == 'Linux'
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 1d43098ee2..ed8a270222 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -33,6 +33,7 @@ jobs:
           # We must use 'fetch-depth: 2', or else the linter won't have another
           # revision to compare to.
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Lint
         shell: bash
diff --git a/.github/workflows/publish-docker.yaml b/.github/workflows/publish-docker.yaml
index c7b01b9141..1cbc05b080 100644
--- a/.github/workflows/publish-docker.yaml
+++ b/.github/workflows/publish-docker.yaml
@@ -48,6 +48,7 @@ jobs:
           ref: ${{ inputs.tag }}
           submodules: recursive
           fetch-tags: true
+          persist-credentials: false
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
diff --git a/.github/workflows/publish-npm.yaml b/.github/workflows/publish-npm.yaml
index a8172c1797..579db44d44 100644
--- a/.github/workflows/publish-npm.yaml
+++ b/.github/workflows/publish-npm.yaml
@@ -44,6 +44,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.tag }}
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index a411e95269..5771c57864 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -55,6 +55,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-tags: true
+          persist-credentials: false
 
       - name: Compute latest
         id: compute
diff --git a/.github/workflows/test-linux-distros.yaml b/.github/workflows/test-linux-distros.yaml
index 992900b174..e47de0734c 100644
--- a/.github/workflows/test-linux-distros.yaml
+++ b/.github/workflows/test-linux-distros.yaml
@@ -32,6 +32,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Configure Build Matrix
         id: configure
@@ -69,6 +70,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
           submodules: recursive
+          persist-credentials: false
 
       - name: Build in Docker
         run: ./packager/testing/test_dockers.sh "${{ matrix.os_name }}"