diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 1fd662c..419f29c 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -20,7 +20,7 @@ permissions: {}
 jobs:
   go:
     permissions:
-      contents: read
       security-events: write
+      contents: read
       actions: read
     uses: typisttech/.github/.github/workflows/audit-go.yml@51e7a334c027d04864092d8b5469d1ccc5dcfcb6 # v9.0.1
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 4933446..5e4bdfc 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -11,11 +11,14 @@ concurrency:
 
 permissions: {}
 
+cache-mode: none
+
 jobs:
   dependabot:
     permissions:
       contents: read
       pull-requests: read
+    cache-mode: none
     uses: typisttech/.github/.github/workflows/dependabot-auto-merge.yml@51e7a334c027d04864092d8b5469d1ccc5dcfcb6 # v9.0.1
     with:
       minor: true
diff --git a/.github/workflows/go-proxy.yml b/.github/workflows/go-proxy.yml
index 5e1bbae..57284c0 100644
--- a/.github/workflows/go-proxy.yml
+++ b/.github/workflows/go-proxy.yml
@@ -10,6 +10,9 @@ concurrency:
 
 permissions: {}
 
+cache-mode: none
+
 jobs:
   go:
+    cache-mode: none
     uses: typisttech/.github/.github/workflows/go-proxy.yml@51e7a334c027d04864092d8b5469d1ccc5dcfcb6 # v9.0.1
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index a5a10b0..4cc6229 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -12,9 +12,12 @@ concurrency:
 
 permissions: {}
 
+cache-mode: none
+
 jobs:
   release-drafter:
     permissions:
       contents: write
       pull-requests: read
+    cache-mode: none
     uses: typisttech/.github/.github/workflows/release-drafter.yml@51e7a334c027d04864092d8b5469d1ccc5dcfcb6 # v9.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c62f0f..e51066e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,16 +34,18 @@ jobs:
       artifact-metadata: write
     cache-mode: none
     runs-on: ubuntu-26.04
+    outputs:
+      dist-artifact-id: ${{ steps.upload-dist.outputs.artifact-id }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        id: checkout
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
         background: true
 
-      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        id: app-token
+      - id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.TASTENDRUCK_CLIENT_ID }}
           private-key: ${{ secrets.TASTENDRUCK_PRIVATE_KEY }}
@@ -78,14 +80,34 @@ jobs:
           subject-checksums: ./dist/checksums.txt
         background: true
 
-      - uses: cloudsmith-io/cloudsmith-cli-action@69e169e2ad9bc9a1599c2dff464061a00fe9f8ba # v3.1.1
+      - id: upload-dist
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          api-key: ${{ secrets.CLOUDSMITH_API_KEY_TASTENDRUCK }}
+          path: |
+            dist/*.apk
+            dist/*.deb
+          if-no-files-found: error
+        background: true
 
-      - run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
-        id: strip-leading-v
-        env:
-          TAG: ${{ github.ref_name }}
+  cloudsmith:
+    needs:
+      - goreleaser
+    cache-mode: none
+    runs-on: ubuntu-slim
+    steps:
+      - parallel:
+        - uses: cloudsmith-io/cloudsmith-cli-action@69e169e2ad9bc9a1599c2dff464061a00fe9f8ba # v3.1.1
+          with:
+            api-key: ${{ secrets.CLOUDSMITH_API_KEY_TASTENDRUCK }}
+
+        - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+          with:
+            artifact-ids: ${{ needs.goreleaser.outputs.dist-artifact-id }}
+
+        - id: strip-leading-v
+          run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          env:
+            TAG: ${{ github.ref_name }}
 
       - parallel:
         - run: cloudsmith push deb typisttech/oss/any-distro/any-version "dist/wpry_${VERSION}_linux_amd64.deb"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 55dcbc5..850300c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,13 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   test:
     name: "test (${{ matrix.go-version || matrix.go-version-file }})"
-    runs-on: ubuntu-26.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         go-version:
@@ -32,28 +32,29 @@ jobs:
         include:
           - go-version: ''
             go-version-file: 'go.mod'
+    runs-on: ubuntu-26.04
     outputs:
       coverage-artifact-id: ${{ steps.upload-coverage.outputs.artifact-id }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
           go-version-file: ${{ matrix.go-version-file }}
 
-      - run: go test -count=1 -race -shuffle=on ./...
-        if: ${{ matrix.go-version-file != 'go.mod' }}
+      - if: ${{ matrix.go-version-file != 'go.mod' }}
+        run: go test -count=1 -race -shuffle=on ./...
 
-      - run: go test -count=1 -race -shuffle=on -coverprofile=coverage.out -covermode=atomic ./...
-        if: ${{ matrix.go-version-file == 'go.mod' }}
+      - if: ${{ matrix.go-version-file == 'go.mod' }}
+        run: go test -count=1 -race -shuffle=on -coverprofile=coverage.out -covermode=atomic ./...
 
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - id: upload-coverage
         if: ${{ matrix.go-version-file == 'go.mod' }}
-        id: upload-coverage
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: coverage
           path: coverage.out
           if-no-files-found: error
         background: true
@@ -63,15 +64,16 @@ jobs:
   codecov:
     needs:
       - test
-    runs-on: ubuntu-slim
     permissions:
-      contents: read
       id-token: write
+      contents: read
+    runs-on: ubuntu-slim
     steps:
       - parallel:
         - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             persist-credentials: false
+
         - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
           with:
             artifact-ids: ${{ needs.test.outputs.coverage-artifact-id }}