diff --git a/.github/workflows/check_dependent_pr.yaml b/.github/workflows/check_dependent_pr.yaml
index 6b3194c8cd9c..07cc46caf523 100644
--- a/.github/workflows/check_dependent_pr.yaml
+++ b/.github/workflows/check_dependent_pr.yaml
@@ -34,6 +34,8 @@ jobs:
       # This is safe as it avoids running untrusted code from the PR branch.
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/clangd_tidy.yaml b/.github/workflows/clangd_tidy.yaml
index 24a32499f112..41987e1e87a6 100644
--- a/.github/workflows/clangd_tidy.yaml
+++ b/.github/workflows/clangd_tidy.yaml
@@ -58,6 +58,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - id: filter
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
diff --git a/.github/workflows/gh_pages_ci.yaml b/.github/workflows/gh_pages_ci.yaml
index 4bff2b5f399d..37c7debb9097 100644
--- a/.github/workflows/gh_pages_ci.yaml
+++ b/.github/workflows/gh_pages_ci.yaml
@@ -28,6 +28,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/gh_pages_deploy.yaml b/.github/workflows/gh_pages_deploy.yaml
index 186e9a8d7713..efbececb808c 100644
--- a/.github/workflows/gh_pages_deploy.yaml
+++ b/.github/workflows/gh_pages_deploy.yaml
@@ -33,6 +33,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -54,11 +56,12 @@ jobs:
       - name: Build with Jekyll
         env:
           JEKYLL_ENV: production
+          STEPS_PAGES_OUTPUTS_BASE_PATH: ${{ steps.pages.outputs.base_path }}
         run: |
           bundle exec jekyll build --verbose \
             --source ./ \
             --destination ./_site \
-            --baseurl "${{ steps.pages.outputs.base_path }}"
+            --baseurl "${STEPS_PAGES_OUTPUTS_BASE_PATH}"
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by
         # default.
diff --git a/.github/workflows/nightly_release.yaml b/.github/workflows/nightly_release.yaml
index 84f6ac303c75..45e55f453dfc 100644
--- a/.github/workflows/nightly_release.yaml
+++ b/.github/workflows/nightly_release.yaml
@@ -69,6 +69,8 @@ jobs:
 
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up remote cache access
         env:
@@ -92,7 +94,7 @@ jobs:
           ./scripts/run_bazel.py \
             --attempts=5 --jobs-on-last-attempt=4 \
             test -c opt --stamp --remote_download_toplevel \
-            --pre_release=nightly --nightly_date=${{ env.nightly_date }} \
+            --pre_release=nightly --nightly_date=${nightly_date} \
             //toolchain \
             //toolchain/install:carbon_toolchain_tar_gz \
             //toolchain/install:carbon_toolchain_tar_gz_test
@@ -113,8 +115,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release create \
-            --title "Nightly build ${{ env.nightly_date }}" \
+            --title "Nightly build ${nightly_date}" \
             --generate-notes \
             --prerelease \
-            v${{ env.release_version }} \
-            "bazel-bin/toolchain/install/carbon_toolchain-${{ env.release_version }}.tar.gz"
+            v${release_version} \
+            "bazel-bin/toolchain/install/carbon_toolchain-${release_version}.tar.gz"
diff --git a/.github/workflows/prek.yaml b/.github/workflows/prek.yaml
index 689b32206b98..62341977fbb3 100644
--- a/.github/workflows/prek.yaml
+++ b/.github/workflows/prek.yaml
@@ -50,6 +50,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Ensure LLVM is set up consistently.
       - uses: ./.github/actions/build-setup-common
diff --git a/.github/workflows/prek_suggestions.yaml b/.github/workflows/prek_suggestions.yaml
index aa68150cb4a2..3060c1cce2c2 100644
--- a/.github/workflows/prek_suggestions.yaml
+++ b/.github/workflows/prek_suggestions.yaml
@@ -48,6 +48,8 @@ jobs:
           reviewdog_version: latest
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download prek output
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
diff --git a/.github/workflows/sync_repos.yaml b/.github/workflows/sync_repos.yaml
index c0001846693b..6db466b70d73 100644
--- a/.github/workflows/sync_repos.yaml
+++ b/.github/workflows/sync_repos.yaml
@@ -32,6 +32,8 @@ jobs:
       # Checkout our main repository.
       - name: Checkout the main repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Run the sync script.
       - name: Sync to other repositories
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 676837c3cd2d..bcd0cc8d8f1c 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -81,6 +81,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - id: test-setup
         uses: ./.github/actions/test-setup