diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9b4c44e..953bf5c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,6 +19,7 @@ on:
     branches: [ "main" ]
   schedule:
     - cron: '23 5 * * 4'
+  workflow_dispatch:
 
 jobs:
   analyze:
@@ -39,11 +40,13 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,4 +73,4 @@ jobs:
        ./workflows/autobuild.sh ${{ matrix.mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 51b1a72..1e8fc33 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,34 +5,49 @@ on:
     - cron: '0 2 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   nightly:
     name: Deploy nightly
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
         refs: [main]
     runs-on: ubuntu-latest
+    env:
+      SIGNING_KEY_PATH: ${{ github.workspace }}/../private.pem
     steps:
+      - name: Validate signing secret
+        run: |
+          test -n "${{ secrets.PRIVATE_KEY_B64 }}" || {
+            echo "PRIVATE_KEY_B64 is required for nightly signed releases." >&2
+            exit 1
+          }
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: ${{ matrix.refs }}
           submodules: 'recursive'
+          persist-credentials: false
       - name: Restore private key
         run: |
-          echo "${{ secrets.PRIVATE_KEY_B64 }}" | base64 -d > private.pem
-          chmod 600 private.pem
+          echo "${{ secrets.PRIVATE_KEY_B64 }}" | base64 -d > "${SIGNING_KEY_PATH}"
+          chmod 600 "${SIGNING_KEY_PATH}"
       - name : Build
         env:
           PICO_SDK_PATH: ../pico-sdk
-          SECURE_BOOT_PKEY: ../private.pem
+          SECURE_BOOT_PKEY: ${{ github.workspace }}/../private.pem
         run: |
            ./workflows/autobuild.sh pico
            ./build_pico_openpgp.sh --no-eddsa
            ./workflows/autobuild.sh esp32
       - name: Delete private key
-        run: rm private.pem
+        if: always()
+        run: rm -f "${SIGNING_KEY_PATH}"
       - name: Update nightly release
         uses: pyTooling/Actions/releaser@v6.7.0
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 213100b..c4a7bd2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,16 +21,22 @@ on:
   schedule:
     - cron: '23 5 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - name: Checkout repository and submodules
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         submodules: recursive
+        persist-credentials: false
     - name: Build in container
       run: ./tests/build-in-docker.sh
     - name: Start emulation and test