diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index 733c6ef423..f88b3d98ba 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -31,6 +31,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/build-fleetctl-msi.yml b/.github/workflows/build-fleetctl-msi.yml
index 92a82699b5..3ba706624a 100644
--- a/.github/workflows/build-fleetctl-msi.yml
+++ b/.github/workflows/build-fleetctl-msi.yml
@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Extract version
         id: extract_version
diff --git a/.github/workflows/build-fleetctl-pkg.yml b/.github/workflows/build-fleetctl-pkg.yml
index 69203d70fd..f306167831 100644
--- a/.github/workflows/build-fleetctl-pkg.yml
+++ b/.github/workflows/build-fleetctl-pkg.yml
@@ -51,6 +51,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Extract version
         id: extract_version
diff --git a/.github/workflows/build-fleetd_tables.yaml b/.github/workflows/build-fleetd_tables.yaml
index 7352290580..4f30b4d5b5 100644
--- a/.github/workflows/build-fleetd_tables.yaml
+++ b/.github/workflows/build-fleetd_tables.yaml
@@ -22,6 +22,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml b/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml
index e382a76116..4103d0934b 100644
--- a/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml
+++ b/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml
@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
diff --git a/.github/workflows/build-orbit.yaml b/.github/workflows/build-orbit.yaml
index 3feaa36cb9..d15e286864 100644
--- a/.github/workflows/build-orbit.yaml
+++ b/.github/workflows/build-orbit.yaml
@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Import signing keys
         env:
diff --git a/.github/workflows/check-automated-doc.yml b/.github/workflows/check-automated-doc.yml
index 37dd8d5f0c..5926edd8c9 100644
--- a/.github/workflows/check-automated-doc.yml
+++ b/.github/workflows/check-automated-doc.yml
@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/check-bomutils-vulnerabilities.yml b/.github/workflows/check-bomutils-vulnerabilities.yml
index 9107efae0b..5b16537bad 100644
--- a/.github/workflows/check-bomutils-vulnerabilities.yml
+++ b/.github/workflows/check-bomutils-vulnerabilities.yml
@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
diff --git a/.github/workflows/check-script-diff.yml b/.github/workflows/check-script-diff.yml
index 20eb455d81..6bdb6bb227 100644
--- a/.github/workflows/check-script-diff.yml
+++ b/.github/workflows/check-script-diff.yml
@@ -25,6 +25,7 @@ jobs:
             - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
               with:
                 fetch-depth: 0  # Fetch full history so merge base can be found
+                persist-credentials: false
 
             - name: Get Changed Manifest Files # fetch the changed manifest files
               id: changed_files
diff --git a/.github/workflows/check-vulnerabilities-in-released-docker-images.yml b/.github/workflows/check-vulnerabilities-in-released-docker-images.yml
index 9d0682b2fc..2909184227 100644
--- a/.github/workflows/check-vulnerabilities-in-released-docker-images.yml
+++ b/.github/workflows/check-vulnerabilities-in-released-docker-images.yml
@@ -30,6 +30,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
diff --git a/.github/workflows/check-wix-vulnerabilities.yml b/.github/workflows/check-wix-vulnerabilities.yml
index adb590eb4f..40a9b8529b 100644
--- a/.github/workflows/check-wix-vulnerabilities.yml
+++ b/.github/workflows/check-wix-vulnerabilities.yml
@@ -37,6 +37,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
diff --git a/.github/workflows/close-stale-fleetie-initiated-issues.yml b/.github/workflows/close-stale-fleetie-initiated-issues.yml
index 0b17d6ae90..af8cb30226 100644
--- a/.github/workflows/close-stale-fleetie-initiated-issues.yml
+++ b/.github/workflows/close-stale-fleetie-initiated-issues.yml
@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 409a2aab4f..09a55bb5f0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -52,6 +52,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     
     - name: Set up Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/collect-eng-metrics-test.yml b/.github/workflows/collect-eng-metrics-test.yml
index a558f9c331..804010436c 100644
--- a/.github/workflows/collect-eng-metrics-test.yml
+++ b/.github/workflows/collect-eng-metrics-test.yml
@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
diff --git a/.github/workflows/collect-eng-metrics.yml b/.github/workflows/collect-eng-metrics.yml
index cd4a1e3271..c861c93261 100644
--- a/.github/workflows/collect-eng-metrics.yml
+++ b/.github/workflows/collect-eng-metrics.yml
@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # 4.4.0
diff --git a/.github/workflows/db-upgrade-test.yml b/.github/workflows/db-upgrade-test.yml
index 40e97b3c35..93d4f63079 100644
--- a/.github/workflows/db-upgrade-test.yml
+++ b/.github/workflows/db-upgrade-test.yml
@@ -32,6 +32,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -41,4 +43,4 @@ jobs:
       - name: Run upgrade test
         run: |
           cd test/upgrade
-          FLEET_VERSION_A=${{ github.event.inputs.from-version }} FLEET_VERSION_B=${{ github.event.inputs.to-version }} go test -v
\ No newline at end of file
+          FLEET_VERSION_A=${{ github.event.inputs.from-version }} FLEET_VERSION_B=${{ github.event.inputs.to-version }} go test -v
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 21b616a843..025c220bf1 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -23,6 +23,8 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
 
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
diff --git a/.github/workflows/deploy-agent-downloader.yml b/.github/workflows/deploy-agent-downloader.yml
index 09545ba673..fccb514069 100644
--- a/.github/workflows/deploy-agent-downloader.yml
+++ b/.github/workflows/deploy-agent-downloader.yml
@@ -32,6 +32,11 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        # Keep the token persisted: the "git fetch --prune --unshallow" step below fetches from the
+        # GitHub origin, so authenticated access avoids anonymous rate limits and keeps working if
+        # the repository ever becomes private.
+        persist-credentials: true
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15
diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 200eb46d15..f02bbca560 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -45,6 +45,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15
diff --git a/.github/workflows/deploy-vulnerability-dashboard.yml b/.github/workflows/deploy-vulnerability-dashboard.yml
index ae54bb22c9..efc3073a3d 100644
--- a/.github/workflows/deploy-vulnerability-dashboard.yml
+++ b/.github/workflows/deploy-vulnerability-dashboard.yml
@@ -32,6 +32,11 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        # Keep the token persisted: the "git fetch --prune --unshallow" step below fetches from the
+        # GitHub origin, so authenticated access avoids anonymous rate limits and keeps working if
+        # the repository ever becomes private.
+        persist-credentials: true
 
     # Configure our access credentials for the Heroku CLI
     - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 39c45e20cf..16ac6989f3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -35,6 +35,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Verify Markdown documentation is free of "here" and "click here" link anchors
       run: |
diff --git a/.github/workflows/dogfood-automated-policy-updates.yml b/.github/workflows/dogfood-automated-policy-updates.yml
index 76def083d9..f711ad6e58 100644
--- a/.github/workflows/dogfood-automated-policy-updates.yml
+++ b/.github/workflows/dogfood-automated-policy-updates.yml
@@ -36,6 +36,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set up Git
         run: |
diff --git a/.github/workflows/dogfood-deploy.yml b/.github/workflows/dogfood-deploy.yml
index 79be05cfbe..35d62efe5d 100644
--- a/.github/workflows/dogfood-deploy.yml
+++ b/.github/workflows/dogfood-deploy.yml
@@ -63,6 +63,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml
index 6f392e3439..7a76479626 100644
--- a/.github/workflows/dogfood-gitops.yml
+++ b/.github/workflows/dogfood-gitops.yml
@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout our repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
 
       - name: Checkout GitOps repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -47,6 +49,7 @@ jobs:
           repository: fleetdm/fleet-gitops
           ref: main
           path: fleet-gitops
+          persist-credentials: false
 
       - name: Apply latest configuration to Fleet
         uses: ./fleet-gitops/.github/gitops-action-fleets
diff --git a/.github/workflows/dogfood-signoz-deploy.yml b/.github/workflows/dogfood-signoz-deploy.yml
index e39208e24b..d4452600e6 100644
--- a/.github/workflows/dogfood-signoz-deploy.yml
+++ b/.github/workflows/dogfood-signoz-deploy.yml
@@ -38,6 +38,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
diff --git a/.github/workflows/dogfood-update-testing-qa-apps.yml b/.github/workflows/dogfood-update-testing-qa-apps.yml
index 4237123654..90a844049d 100644
--- a/.github/workflows/dogfood-update-testing-qa-apps.yml
+++ b/.github/workflows/dogfood-update-testing-qa-apps.yml
@@ -38,6 +38,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Install jq
         run: |
diff --git a/.github/workflows/e2e-agent.yml b/.github/workflows/e2e-agent.yml
index b39098d7e3..cbc561e63f 100644
--- a/.github/workflows/e2e-agent.yml
+++ b/.github/workflows/e2e-agent.yml
@@ -303,6 +303,7 @@ jobs:
         fetch-depth: 1
         sparse-checkout: |
           it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
+        persist-credentials: false
 
     - name: Uninstall Orbit
       run: |
@@ -518,6 +519,7 @@ jobs:
         fetch-depth: 1
         sparse-checkout: |
           it-and-security/lib/windows/scripts/uninstall-fleetd-windows.ps1
+        persist-credentials: false
 
     - name: Uninstall Orbit
       shell: powershell
@@ -566,4 +568,4 @@ jobs:
       if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
       run: gh run cancel ${{ github.run_id }} --repo fleetdm/fleet
       env:
-        GH_TOKEN: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
\ No newline at end of file
+        GH_TOKEN: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index fc77afde48..e82c84a5db 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -77,6 +77,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -239,6 +241,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -282,6 +286,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -350,6 +356,7 @@ jobs:
         with:
           sparse-checkout: it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download pkg
         id: download
diff --git a/.github/workflows/fleetctl-preview-latest.yml b/.github/workflows/fleetctl-preview-latest.yml
index f677e9de0e..439deceabc 100644
--- a/.github/workflows/fleetctl-preview-latest.yml
+++ b/.github/workflows/fleetctl-preview-latest.yml
@@ -64,6 +64,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/fleetd-tuf.yml b/.github/workflows/fleetd-tuf.yml
index 37ecc6e904..dd5f5346dc 100644
--- a/.github/workflows/fleetd-tuf.yml
+++ b/.github/workflows/fleetd-tuf.yml
@@ -34,6 +34,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml
index 6d77d3b4b5..8f273a7743 100644
--- a/.github/workflows/generate-desktop-targets.yml
+++ b/.github/workflows/generate-desktop-targets.yml
@@ -10,9 +10,8 @@ defaults:
     # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
     shell: bash
 
+# Least-privilege default; jobs that build attestations grant id-token/attestations at the job level.
 permissions:
-  id-token: write
-  attestations: write
   contents: read
 
 jobs:
@@ -34,6 +33,10 @@ jobs:
     # later, avoiding runtime errors on systems using macOS 14 or newer.
     runs-on: macos-14
     needs: set-version
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -42,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -113,6 +118,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -161,6 +168,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -202,6 +211,10 @@ jobs:
   desktop-linux:
     needs: set-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -210,6 +223,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -238,6 +253,10 @@ jobs:
   desktop-linux-arm64:
     needs: set-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -246,6 +265,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/generate-nudge-targets.yml b/.github/workflows/generate-nudge-targets.yml
index f1591d10d6..7845b1f3e8 100644
--- a/.github/workflows/generate-nudge-targets.yml
+++ b/.github/workflows/generate-nudge-targets.yml
@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate nudge.app.tar.gz
         run: make nudge-app-tar-gz version=$NUDGE_VERSION out-path=.
diff --git a/.github/workflows/generate-osqueryd-targets.yml b/.github/workflows/generate-osqueryd-targets.yml
index 0ce0a9f979..280552b23f 100644
--- a/.github/workflows/generate-osqueryd-targets.yml
+++ b/.github/workflows/generate-osqueryd-targets.yml
@@ -26,13 +26,17 @@ defaults:
 env:
   OSQUERY_VERSION: 5.23.0
 
+# Least-privilege default; each build job grants id-token/attestations at the job level.
 permissions:
-  id-token: write
-  attestations: write
+  contents: read
 
 jobs:
   generate-macos:
     runs-on: macos-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -41,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate osqueryd.app.tar.gz
         run: |
@@ -70,6 +76,10 @@ jobs:
 
   generate-linux:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -78,6 +88,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download and extract osqueryd for linux
         run: |
@@ -101,6 +113,10 @@ jobs:
 
   generate-linux-arm64:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -109,6 +125,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install file
         run: |
@@ -136,6 +154,10 @@ jobs:
 
   generate-windows:
     runs-on: windows-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -144,6 +166,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download osquery msi for Windows
         run: |
@@ -169,6 +193,10 @@ jobs:
 
   generate-windows-arm64:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for attest-build-provenance
+      attestations: write # required for attest-build-provenance
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
@@ -177,6 +205,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download osquery msi for Windows
         run: |
diff --git a/.github/workflows/generate-swift-dialog-targets.yml b/.github/workflows/generate-swift-dialog-targets.yml
index 3ff43585d3..586c1f53d4 100644
--- a/.github/workflows/generate-swift-dialog-targets.yml
+++ b/.github/workflows/generate-swift-dialog-targets.yml
@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Generate swiftDialog.app.tar.gz
         run: make swift-dialog-app-tar-gz version=${SWIFT_DIALOG_VERSION} build=${SWIFT_DIALOG_BUILD} out-path=.
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index ead1265c58..3f287142e3 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -60,6 +60,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -123,6 +125,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0  # Fetch full history for accurate diff
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml
index cdf4d93ce8..e41ed94e9e 100644
--- a/.github/workflows/goreleaser-fleet.yaml
+++ b/.github/workflows/goreleaser-fleet.yaml
@@ -40,6 +40,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0 # Needed for goreleaser
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
@@ -235,6 +236,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Download signed fleetctl binary
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
@@ -298,6 +300,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Download unsigned fleetctl binary
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml
index 617cddacb5..6c6a28ea46 100644
--- a/.github/workflows/goreleaser-orbit.yaml
+++ b/.github/workflows/goreleaser-orbit.yaml
@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -94,6 +96,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -141,6 +145,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -185,6 +191,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
@@ -241,6 +249,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Note that goreleaser does not like the orbit- prefixed flag unless you use the closed-source
       # paid version. We pay for goreleaser, but using the closed source build would weaken our
diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml
index 8678856eed..f59286bec2 100644
--- a/.github/workflows/goreleaser-snapshot-fleet.yaml
+++ b/.github/workflows/goreleaser-snapshot-fleet.yaml
@@ -49,6 +49,7 @@ jobs:
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          persist-credentials: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
diff --git a/.github/workflows/incubate-website-deps.yml b/.github/workflows/incubate-website-deps.yml
index 52d8955b26..5cd98f6120 100644
--- a/.github/workflows/incubate-website-deps.yml
+++ b/.github/workflows/incubate-website-deps.yml
@@ -30,6 +30,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0  # full history needed to compute commit timestamp
+          persist-credentials: false
 
       - name: Verify 72-hour incubation
         if: github.event_name == 'pull_request'
diff --git a/.github/workflows/ingest-maintained-apps.yml b/.github/workflows/ingest-maintained-apps.yml
index 42d64e5a85..a90f83e48c 100644
--- a/.github/workflows/ingest-maintained-apps.yml
+++ b/.github/workflows/ingest-maintained-apps.yml
@@ -39,6 +39,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.head_ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/loadtest-infra.yml b/.github/workflows/loadtest-infra.yml
index 667869556f..75d4eecd1c 100644
--- a/.github/workflows/loadtest-infra.yml
+++ b/.github/workflows/loadtest-infra.yml
@@ -95,6 +95,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
diff --git a/.github/workflows/loadtest-osquery-perf.yml b/.github/workflows/loadtest-osquery-perf.yml
index 7f3b164f28..4743001969 100644
--- a/.github/workflows/loadtest-osquery-perf.yml
+++ b/.github/workflows/loadtest-osquery-perf.yml
@@ -84,6 +84,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
diff --git a/.github/workflows/loadtest-shared.yml b/.github/workflows/loadtest-shared.yml
index d6b0b5c90d..ca7935f088 100644
--- a/.github/workflows/loadtest-shared.yml
+++ b/.github/workflows/loadtest-shared.yml
@@ -43,6 +43,8 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+        with:
+          persist-credentials: false
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
diff --git a/.github/workflows/pr-helm.yaml b/.github/workflows/pr-helm.yaml
index c7112964c3..84c9783311 100644
--- a/.github/workflows/pr-helm.yaml
+++ b/.github/workflows/pr-helm.yaml
@@ -35,6 +35,8 @@ jobs:
 
     - name: checkout
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     - name: create temp dir
       run: mkdir -p helm-temp
     - name: helm dependency build
diff --git a/.github/workflows/product-eng-handbook-summary.yml b/.github/workflows/product-eng-handbook-summary.yml
index 74097c43b7..24cca81f27 100644
--- a/.github/workflows/product-eng-handbook-summary.yml
+++ b/.github/workflows/product-eng-handbook-summary.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Collect handbook diffs
         id: diffs
diff --git a/.github/workflows/publish-go-module.yml b/.github/workflows/publish-go-module.yml
index 685368668a..c282c52d59 100644
--- a/.github/workflows/publish-go-module.yml
+++ b/.github/workflows/publish-go-module.yml
@@ -29,6 +29,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -39,4 +41,4 @@ jobs:
 
       - name: Publish go module
         run: |
-          GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@${{ github.ref_name }}
\ No newline at end of file
+          GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@${{ github.ref_name }}
diff --git a/.github/workflows/randokiller-go.yml b/.github/workflows/randokiller-go.yml
index 0b0ed3e9fe..fb23ecc8ce 100644
--- a/.github/workflows/randokiller-go.yml
+++ b/.github/workflows/randokiller-go.yml
@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Parse Config
         id: get_config_json
@@ -65,6 +67,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/release-fleetctl-docker-deps.yaml b/.github/workflows/release-fleetctl-docker-deps.yaml
index 9e3cabc8dd..9f2a258917 100644
--- a/.github/workflows/release-fleetctl-docker-deps.yaml
+++ b/.github/workflows/release-fleetctl-docker-deps.yaml
@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/release-fleetd-base.yml b/.github/workflows/release-fleetd-base.yml
index 1e930293ee..b49987070d 100644
--- a/.github/workflows/release-fleetd-base.yml
+++ b/.github/workflows/release-fleetd-base.yml
@@ -63,6 +63,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -148,6 +149,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Install fleetctl
         run: npm install -g fleetctl
@@ -292,6 +294,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download signed artifact
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
@@ -331,6 +334,7 @@ jobs:
             .github/actions/r2-upload/action.yml
             .github/scripts/rclone-install.sh
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Download latest-tuf-meta.json artifact
         uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
diff --git a/.github/workflows/release-fleetd-chrome-beta.yml b/.github/workflows/release-fleetd-chrome-beta.yml
index 56731b4284..25cd7b61e6 100644
--- a/.github/workflows/release-fleetd-chrome-beta.yml
+++ b/.github/workflows/release-fleetd-chrome-beta.yml
@@ -45,6 +45,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Run test
         working-directory: ./ee/fleetd-chrome
diff --git a/.github/workflows/release-fleetd-chrome.yml b/.github/workflows/release-fleetd-chrome.yml
index f89605403c..0543718bea 100644
--- a/.github/workflows/release-fleetd-chrome.yml
+++ b/.github/workflows/release-fleetd-chrome.yml
@@ -46,6 +46,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Run test
         working-directory: ./ee/fleetd-chrome
diff --git a/.github/workflows/release-helm.yaml b/.github/workflows/release-helm.yaml
index 1bcf5c4d60..38a73c78e7 100644
--- a/.github/workflows/release-helm.yaml
+++ b/.github/workflows/release-helm.yaml
@@ -30,6 +30,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
     - uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml
index 0ebe77c3cb..99b12cd988 100644
--- a/.github/workflows/scorecards-analysis.yml
+++ b/.github/workflows/scorecards-analysis.yml
@@ -10,8 +10,9 @@ on:
   push:
     branches: [ "main" ]
 
-# Declare default permissions as read only.
-permissions: read-all
+# Declare least-privilege default permissions; the analysis job grants what it needs at the job level.
+permissions:
+  contents: read
 
 jobs:
   gradle-wrapper-validation:
@@ -36,6 +37,8 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
+      # Needed to check out the repository (explicit, for clarity)
+      contents: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).
diff --git a/.github/workflows/secrets-to-confidential.yml b/.github/workflows/secrets-to-confidential.yml
index 7e65e9173e..1e3d3b90d7 100644
--- a/.github/workflows/secrets-to-confidential.yml
+++ b/.github/workflows/secrets-to-confidential.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
   cancel-in-progress: true
 
+# The sync uses a dedicated PAT (SECRETS_GITHUB_PAT), so the default GITHUB_TOKEN needs no permissions.
+permissions: {}
+
 jobs:
   sync_secrets:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sync-maintained-apps-outputs.yml b/.github/workflows/sync-maintained-apps-outputs.yml
index 40a641b0cf..fb66c663a5 100644
--- a/.github/workflows/sync-maintained-apps-outputs.yml
+++ b/.github/workflows/sync-maintained-apps-outputs.yml
@@ -51,6 +51,8 @@ jobs:
 
       - name: Checkout Repository
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Verify Source Directory Exists
         run: |
diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml
index 81b2c31d8f..0d20f2cd24 100644
--- a/.github/workflows/test-android.yml
+++ b/.github/workflows/test-android.yml
@@ -43,6 +43,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -151,6 +153,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -253,6 +257,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -363,6 +369,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
 
       - name: Download coverage artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
diff --git a/.github/workflows/test-db-changes.yml b/.github/workflows/test-db-changes.yml
index 436478496e..9c272effd2 100644
--- a/.github/workflows/test-db-changes.yml
+++ b/.github/workflows/test-db-changes.yml
@@ -39,6 +39,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     # TODO: This doesn't cover all scenarios since other PRs might
     # be merged into `main` after this check has passed.
diff --git a/.github/workflows/test-fleet-agent-downloader-changes.yml b/.github/workflows/test-fleet-agent-downloader-changes.yml
index 9609acc937..516d83c198 100644
--- a/.github/workflows/test-fleet-agent-downloader-changes.yml
+++ b/.github/workflows/test-fleet-agent-downloader-changes.yml
@@ -33,6 +33,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Set the Node.js version
     - name: Use Node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/test-fleet-mcp.yml b/.github/workflows/test-fleet-mcp.yml
index 8061c5635b..ada1e66d18 100644
--- a/.github/workflows/test-fleet-mcp.yml
+++ b/.github/workflows/test-fleet-mcp.yml
@@ -38,6 +38,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-fleet-slackbot.yml b/.github/workflows/test-fleet-slackbot.yml
index fdb15b0d01..1b6fe12ed1 100644
--- a/.github/workflows/test-fleet-slackbot.yml
+++ b/.github/workflows/test-fleet-slackbot.yml
@@ -41,6 +41,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
diff --git a/.github/workflows/test-fleetd-chrome.yml b/.github/workflows/test-fleetd-chrome.yml
index 8db5884e49..80447c6586 100644
--- a/.github/workflows/test-fleetd-chrome.yml
+++ b/.github/workflows/test-fleetd-chrome.yml
@@ -42,6 +42,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: JS Dependency Cache
         id: js-cache
diff --git a/.github/workflows/test-fma-darwin-pr-only.yml b/.github/workflows/test-fma-darwin-pr-only.yml
index 8f9dd62b94..46c46cedea 100644
--- a/.github/workflows/test-fma-darwin-pr-only.yml
+++ b/.github/workflows/test-fma-darwin-pr-only.yml
@@ -45,6 +45,7 @@ jobs:
           fetch-depth: 0 # Need full history to compare with base branch
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-fma-darwin.yml b/.github/workflows/test-fma-darwin.yml
index 1fd0b3d9a1..b2230168dc 100644
--- a/.github/workflows/test-fma-darwin.yml
+++ b/.github/workflows/test-fma-darwin.yml
@@ -41,6 +41,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-fma-windows-pr-only.yml b/.github/workflows/test-fma-windows-pr-only.yml
index a780ddfa52..0bb9587223 100644
--- a/.github/workflows/test-fma-windows-pr-only.yml
+++ b/.github/workflows/test-fma-windows-pr-only.yml
@@ -45,6 +45,7 @@ jobs:
           fetch-depth: 0 # Need full history to compare with base branch
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-fma-windows.yml b/.github/workflows/test-fma-windows.yml
index 3938f4e73e..2ee52d4fed 100644
--- a/.github/workflows/test-fma-windows.yml
+++ b/.github/workflows/test-fma-windows.yml
@@ -41,6 +41,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.ref }}
           path: fleet
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-go-activity.yaml b/.github/workflows/test-go-activity.yaml
index 0ba1623999..ad07c6585f 100644
--- a/.github/workflows/test-go-activity.yaml
+++ b/.github/workflows/test-go-activity.yaml
@@ -96,6 +96,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
       - name: Download artifacts
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
diff --git a/.github/workflows/test-go-suite.yaml b/.github/workflows/test-go-suite.yaml
index 99e16ac2cf..ea10886991 100644
--- a/.github/workflows/test-go-suite.yaml
+++ b/.github/workflows/test-go-suite.yaml
@@ -116,6 +116,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-go-windows.yml b/.github/workflows/test-go-windows.yml
index c7b9ef5f11..5838640a0f 100644
--- a/.github/workflows/test-go-windows.yml
+++ b/.github/workflows/test-go-windows.yml
@@ -46,6 +46,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
index 6c7cd891b7..0b0d1c6794 100644
--- a/.github/workflows/test-go.yaml
+++ b/.github/workflows/test-go.yaml
@@ -132,6 +132,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -234,6 +236,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
       - name: Download artifacts
         uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
diff --git a/.github/workflows/test-js.yml b/.github/workflows/test-js.yml
index 99126034b4..2860b5ef60 100644
--- a/.github/workflows/test-js.yml
+++ b/.github/workflows/test-js.yml
@@ -44,6 +44,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
@@ -89,6 +91,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
diff --git a/.github/workflows/test-mock-changes.yml b/.github/workflows/test-mock-changes.yml
index 3212a07fac..5f74a61019 100644
--- a/.github/workflows/test-mock-changes.yml
+++ b/.github/workflows/test-mock-changes.yml
@@ -38,6 +38,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-native-tooling-packaging.yml b/.github/workflows/test-native-tooling-packaging.yml
index fcba66f5cd..94a9f7a427 100644
--- a/.github/workflows/test-native-tooling-packaging.yml
+++ b/.github/workflows/test-native-tooling-packaging.yml
@@ -50,6 +50,8 @@ jobs:
     - name: Checkout Code
       if: ${{ matrix.build_type ==  'local' }}
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       if: ${{ matrix.build_type ==  'local' }}
diff --git a/.github/workflows/test-packaging-build-docker-deps.yml b/.github/workflows/test-packaging-build-docker-deps.yml
index 6daebb86f4..529f562011 100644
--- a/.github/workflows/test-packaging-build-docker-deps.yml
+++ b/.github/workflows/test-packaging-build-docker-deps.yml
@@ -51,6 +51,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-packaging.yml b/.github/workflows/test-packaging.yml
index 88b302d78e..c8d9f109e0 100644
--- a/.github/workflows/test-packaging.yml
+++ b/.github/workflows/test-packaging.yml
@@ -78,6 +78,8 @@ jobs:
 
       - name: Checkout Code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/test-puppet.yml b/.github/workflows/test-puppet.yml
index a8a8bf7f75..76ec953ab8 100644
--- a/.github/workflows/test-puppet.yml
+++ b/.github/workflows/test-puppet.yml
@@ -40,6 +40,7 @@ jobs:
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Ruby Gems
       working-directory: ./ee/tools/puppet/fleetdm/
diff --git a/.github/workflows/test-stale-fleetie-issue-scripts.yml b/.github/workflows/test-stale-fleetie-issue-scripts.yml
index 20e6edf413..295681d930 100644
--- a/.github/workflows/test-stale-fleetie-issue-scripts.yml
+++ b/.github/workflows/test-stale-fleetie-issue-scripts.yml
@@ -54,6 +54,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/test-vulnerability-dashboard-changes.yml b/.github/workflows/test-vulnerability-dashboard-changes.yml
index 3b4c8b6265..9db1fac719 100644
--- a/.github/workflows/test-vulnerability-dashboard-changes.yml
+++ b/.github/workflows/test-vulnerability-dashboard-changes.yml
@@ -33,6 +33,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     # Set the Node.js version
     - name: Use Node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/test-website.yml b/.github/workflows/test-website.yml
index 0ddf283d6e..4c761b3d1a 100644
--- a/.github/workflows/test-website.yml
+++ b/.github/workflows/test-website.yml
@@ -43,6 +43,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       # Set the Node.js version
       - name: Use Node.js ${{ matrix.node-version }}
diff --git a/.github/workflows/test-yml-specs.yml b/.github/workflows/test-yml-specs.yml
index 542c2cbdbe..efd14a10c8 100644
--- a/.github/workflows/test-yml-specs.yml
+++ b/.github/workflows/test-yml-specs.yml
@@ -43,6 +43,8 @@ jobs:
 
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      with:
+        persist-credentials: false
 
     - name: Install Go
       uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/tfvalidate.yml b/.github/workflows/tfvalidate.yml
index 46615d3dfa..ea1ad035cc 100644
--- a/.github/workflows/tfvalidate.yml
+++ b/.github/workflows/tfvalidate.yml
@@ -37,6 +37,8 @@ jobs:
 
       - name: Clone repo
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          persist-credentials: false
 
       - name: Install terraform
         uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 6f1962a74a..8e15f2b917 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -103,6 +103,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ matrix.branch || github.ref }}
+          persist-credentials: false
 
       - name: Capture checked-out commit SHA
         id: sha
diff --git a/.github/workflows/update-certs.yml b/.github/workflows/update-certs.yml
index c46ff4c5d3..f38dc6a14f 100644
--- a/.github/workflows/update-certs.yml
+++ b/.github/workflows/update-certs.yml
@@ -32,6 +32,8 @@ jobs:
 
     - name: Checkout code
       uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v.24.0
+      with:
+        persist-credentials: false
 
     # We trust own version of mk-ca-bundle.pl and its output, but as an extra check
     # we compare with the cacert.pem served by https://curl.se/ca/cacert.pem (this
diff --git a/.github/workflows/update-osquery-versions.yml b/.github/workflows/update-osquery-versions.yml
index cfd96be574..34cda8fa99 100644
--- a/.github/workflows/update-osquery-versions.yml
+++ b/.github/workflows/update-osquery-versions.yml
@@ -21,6 +21,8 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
         with:
diff --git a/.github/workflows/validate-maintained-apps-inputs.yml b/.github/workflows/validate-maintained-apps-inputs.yml
index ce086d6238..c66484530b 100644
--- a/.github/workflows/validate-maintained-apps-inputs.yml
+++ b/.github/workflows/validate-maintained-apps-inputs.yml
@@ -30,6 +30,7 @@ jobs:
           fetch-depth: 1
           ref: ${{ github.head_ref }}
           path: fleet
+          persist-credentials: false
 
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml
index 47f4ce83ab..97c136277a 100644
--- a/.github/zizmor-gate.yml
+++ b/.github/zizmor-gate.yml
@@ -12,12 +12,19 @@
 # .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
 
 rules:
-  artipacked: # 112 findings
-    disable: true
-  excessive-permissions: # 6 findings
-    disable: true
-  misfeature: # 11 findings
-    disable: true
+  # The misfeature rule stays ENABLED so new workflows are still checked; we only waive the
+  # specific Windows signing/build workflows below. Their findings are all `shell: cmd` notices:
+  # zizmor cannot introspect CMD scripts, so it emits a Low-severity analysis-limitation note
+  # rather than a real finding, and these workflows require the Windows CMD shell. Matching is by
+  # filename, so keep these names unique.
+  misfeature:
+    ignore:
+      - build-fleetctl-msi.yml
+      - code-sign-windows.yml
+      - e2e-agent.yml
+      - fleet-and-orbit.yml
+      - generate-osqueryd-targets.yml
+      - goreleaser-fleet.yaml
   ref-version-mismatch: # 44 findings (online audit)
     disable: true
   template-injection: # 234 findings