diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6917ff8021..631358c42f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -9,6 +9,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
@@ -16,6 +19,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
 
@@ -48,6 +53,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
 
@@ -71,6 +78,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
 
@@ -88,6 +97,8 @@ jobs:
     if: github.repository_owner == 'coder' && github.actor != 'dependabot[bot]'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
 
@@ -107,6 +118,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
 
diff --git a/.github/workflows/pre-release.yaml b/.github/workflows/pre-release.yaml
index 81ab098207..eb9361f7ed 100644
--- a/.github/workflows/pre-release.yaml
+++ b/.github/workflows/pre-release.yaml
@@ -5,9 +5,7 @@ on:
       - "v*-pre"
 
 permissions:
-  # Required to publish a release
-  contents: write
-  pull-requests: read
+  contents: read
 
 jobs:
   package:
@@ -17,6 +15,8 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm, Node.js, and dependencies
         uses: ./.github/actions/setup
@@ -65,6 +65,10 @@ jobs:
   publish:
     name: Publish Extension and Create Pre-Release
     needs: package
+    permissions:
+      # Required to create the GitHub release
+      contents: write
+      pull-requests: read
     uses: ./.github/workflows/publish-extension.yaml
     with:
       version: ${{ needs.package.outputs.version }}
diff --git a/.github/workflows/publish-extension.yaml b/.github/workflows/publish-extension.yaml
index 60758fbf00..e9a36cf5a3 100644
--- a/.github/workflows/publish-extension.yaml
+++ b/.github/workflows/publish-extension.yaml
@@ -22,12 +22,17 @@ jobs:
   setup:
     name: Setup
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     outputs:
       packageName: ${{ steps.package.outputs.packageName }}
+      vsceVersion: ${{ steps.versions.outputs.vsceVersion }}
       hasVscePat: ${{ steps.check-secrets.outputs.hasVscePat }}
       hasOvsxPat: ${{ steps.check-secrets.outputs.hasOvsxPat }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -45,6 +50,15 @@ jobs:
           echo "packageName=$PACKAGE_NAME" >> $GITHUB_OUTPUT
           echo "Package name: $PACKAGE_NAME"
 
+      - name: Determine vsce version from lockfile
+        id: versions
+        # Explicit bash enables pipefail: an extraction miss fails the job
+        # instead of silently installing latest.
+        shell: bash
+        run: |
+          VSCE_VERSION="$(grep -m 1 -o "@vscode/vsce@[0-9][^'(]*" pnpm-lock.yaml | cut -d @ -f 3)"
+          echo "vsceVersion=$VSCE_VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Check secrets
         id: check-secrets
         env:
@@ -58,6 +72,9 @@ jobs:
     name: Publish to VS Marketplace
     needs: setup
     runs-on: ubuntu-24.04
+    environment: publish
+    permissions:
+      contents: read
     if: ${{ needs.setup.outputs.hasVscePat == 'true' }}
     steps:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -65,25 +82,32 @@ jobs:
           node-version: "22"
 
       - name: Install vsce
-        run: npm install -g @vscode/vsce
+        env:
+          VSCE_VERSION: ${{ needs.setup.outputs.vsceVersion }}
+        run: npm install -g "@vscode/vsce@${VSCE_VERSION}"
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: extension-${{ inputs.version }}
 
       - name: Publish to VS Marketplace
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
         run: |
           echo "Publishing version ${{ inputs.version }} to VS Marketplace"
           if [ "${{ inputs.isPreRelease }}" = "true" ]; then
-            vsce publish --pre-release --packagePath "./${{ needs.setup.outputs.packageName }}" -p ${{ secrets.VSCE_PAT }}
+            vsce publish --pre-release --packagePath "./${{ needs.setup.outputs.packageName }}"
           else
-            vsce publish --packagePath "./${{ needs.setup.outputs.packageName }}" -p ${{ secrets.VSCE_PAT }}
+            vsce publish --packagePath "./${{ needs.setup.outputs.packageName }}"
           fi
 
   publishOVSX:
     name: Publish to Open VSX
     needs: setup
     runs-on: ubuntu-24.04
+    environment: publish
+    permissions:
+      contents: read
     if: ${{ needs.setup.outputs.hasOvsxPat == 'true' }}
     steps:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -91,25 +115,31 @@ jobs:
           node-version: "22"
 
       - name: Install ovsx
-        run: npm install -g ovsx
+        run: npm install -g ovsx@1.0.2
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: extension-${{ inputs.version }}
 
       - name: Publish to Open VSX
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
         run: |
           echo "Publishing version ${{ inputs.version }} to Open VSX"
           if [ "${{ inputs.isPreRelease }}" = "true" ]; then
-            ovsx publish "./${{ needs.setup.outputs.packageName }}" --pre-release -p ${{ secrets.OVSX_PAT }}
+            ovsx publish "./${{ needs.setup.outputs.packageName }}" --pre-release
           else
-            ovsx publish "./${{ needs.setup.outputs.packageName }}" -p ${{ secrets.OVSX_PAT }}
+            ovsx publish "./${{ needs.setup.outputs.packageName }}"
           fi
 
   publishGH:
     name: Create GitHub ${{ inputs.isPreRelease && 'Pre-' || '' }}Release
     needs: setup
     runs-on: ubuntu-24.04
+    permissions:
+      # Required to create the release and generate release notes
+      contents: write
+      pull-requests: read
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d5d0a5597f..6de07d0097 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,9 +6,7 @@ on:
       - "!v*-pre"
 
 permissions:
-  # Required to publish a release
-  contents: write
-  pull-requests: read
+  contents: read
 
 jobs:
   package:
@@ -20,6 +18,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Verify tag is on main
         run: |
@@ -74,6 +73,10 @@ jobs:
   publish:
     name: Publish Extension and Create Release
     needs: package
+    permissions:
+      # Required to create the GitHub release
+      contents: write
+      pull-requests: read
     uses: ./.github/workflows/publish-extension.yaml
     with:
       version: ${{ needs.package.outputs.version }}