diff --git a/.github/workflows/.ncmake-workflows.json b/.github/workflows/.ncmake-workflows.json
index dd369d4..8d62afe 100644
--- a/.github/workflows/.ncmake-workflows.json
+++ b/.github/workflows/.ncmake-workflows.json
@@ -30,8 +30,8 @@
     "source": "nextcloud"
   },
   "release.yml": {
-    "hash": "8c4de5bd59955ce652be722125192e975c6084b97534389f7ac604688d3dc2eb",
-    "sha": "d88a3f0ea9ce8a670fbc5b8ce47f6c2236eba911",
+    "hash": "108ae3aac0e87f2150c84a895959150d89978c211c7ab3f78ff5db0ca61518a1",
+    "sha": "d6f7d4cbf2979ab8e1a41cf4c537b8ded3bfd1a1",
     "source": "ncmake"
   },
   "reuse.yml": {
@@ -40,8 +40,8 @@
     "source": "nextcloud"
   },
   "workflow-updater.yml": {
-    "hash": "2c0a58585fdb09fc8bd5b4ab6b8a4647ffbc6620823383b430515a1c8d10e0e1",
-    "sha": "9f8b81d87ae4c77b5d68846642004ef4252da308",
+    "hash": "48a7857aa06325d538b7fe62932e26b49fd0e6d9ba649a6951899b1072129363",
+    "sha": "e419581452bca16e3b0004e563f2817406f80984",
     "source": "ncmake"
   }
 }
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d88a3f0..d6f7d4c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ name: Release tarball
 #
 # appinfo/signature.json is not produced here. It is signed at tag time on the
 # maintainer's machine, where the key is, and travels in a secret gist whose id the
-# signed tag message names. This job reads it from there without any token and
+# signed tag message names. The build job reads it from there without any token and
 # verifies it against the certificate committed as .ncmake/certificate.crt before
 # it packs, so a runner build that does not match the signed one fails the release
 # instead of shipping.
@@ -27,14 +27,24 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
+
+# A second run for the same release waits instead of attaching at the same time.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   tarball:
+    name: Build the tarball
     runs-on: ubuntu-latest
+    # The build runs the app's composer and npm steps, so it gets no token that
+    # may write to the repository; only the attach job below holds one.
+    permissions:
+      contents: read # checkout
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           # The tag object itself: its message carries the gist id, and its date
@@ -75,17 +85,27 @@ jobs:
           make build
           if [ -n "${SIGNED:-}" ]; then make integrity-check dist; else make dist; fi
 
-      - name: Locate the tarball
-        run: echo "TARBALL=$(ls build/artifacts/dist/*.tar.gz)" >> "$GITHUB_ENV"
-
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-tarball
           path: build/artifacts/dist/*.tar.gz
 
+  attach:
+    name: Attach to release
+    needs: tarball
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # gh release upload
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release-tarball
+          path: dist
+
       - name: Attach to release
-        if: github.event_name == 'release'
-        run: gh release upload "${GITHUB_REF_NAME}" "${TARBALL}" --clobber
+        run: gh release upload "${GITHUB_REF_NAME}" dist/*.tar.gz --clobber --repo "${GITHUB_REPOSITORY}"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/workflow-updater.yml b/.github/workflows/workflow-updater.yml
index 9f8b81d..e419581 100644
--- a/.github/workflows/workflow-updater.yml
+++ b/.github/workflows/workflow-updater.yml
@@ -41,7 +41,7 @@ on:
   # "@ncmake-updater rebase" in a pull request comment. issue_comment fires for
   # every comment in the repository, plain issues included; the update job
   # filters down to pull request comments that carry the command.
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers] commands only from OWNER/MEMBER/COLLABORATOR, no comment text in run:, default branch checked out
     types: [created]
 
 permissions:
@@ -84,6 +84,11 @@ jobs:
         with:
           client-id: ${{ secrets.NCMAKE_UPDATER_CLIENT_ID }}
           private-key: ${{ secrets.NCMAKE_UPDATER_PRIVATE_KEY }}
+          # Without these the token carries every permission of the app.
+          permission-contents: write # push the update branch
+          permission-pull-requests: write # open the pull request
+          permission-workflows: write # the branch changes .github/workflows/
+          permission-metadata: read
 
       - name: Acknowledge the command
         if: github.event_name == 'issue_comment'
@@ -172,6 +177,8 @@ jobs:
         with:
           client-id: ${{ secrets.NCMAKE_UPDATER_CLIENT_ID }}
           private-key: ${{ secrets.NCMAKE_UPDATER_PRIVATE_KEY }}
+          permission-contents: write # delete the branch
+          permission-metadata: read
 
       - name: Delete the merged updater branch if it is still there
         env: