diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index de88f14..17f6c4d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -26,6 +26,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -65,6 +66,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -116,6 +118,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -174,6 +177,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 85c99cb..58b36a5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install PHP with extensions
         uses: shivammathur/setup-php@v2
@@ -32,7 +34,7 @@ jobs:
         run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
 
       - name: Parse ChangeLog
-        run: build/scripts/extract-release-notes.php ${{ env.RELEASE_TAG }} > release-notes.md
+        run: build/scripts/extract-release-notes.php ${RELEASE_TAG} > release-notes.md
 
       - name: Create release
         uses: ncipollo/release-action@v1