diff --git a/.github/workflows/doc-tests.yml b/.github/workflows/doc-tests.yml
index 0e8e21e6ea..1c70979c1b 100644
--- a/.github/workflows/doc-tests.yml
+++ b/.github/workflows/doc-tests.yml
@@ -19,6 +19,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index cb0e2c3546..75d958d5d4 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -12,6 +12,8 @@ jobs:
       SKIP: no-commit-to-branch
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@v5
       with:
         python-version: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7183aefe03..c316ad7841 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,10 +22,13 @@ jobs:
       # Check out the repo
       - uses: actions/checkout@v4
         if: ${{ github.event_name == 'release' }}
+        with:
+          persist-credentials: false
       - uses: actions/checkout@v4
         if: ${{ github.event_name == 'workflow_dispatch' }}
         with:
           ref: ${{ github.event.inputs.ref }}
+          persist-credentials: false
 
       # Setup python
       - uses: actions/setup-python@v5
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 6af26cdf77..33d3600b69 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -17,9 +17,10 @@ jobs:
 
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - id: ShellCheck
         name: Differential ShellCheck