diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
index 2e054c9fadd..0b7b18ac05f 100644
--- a/.github/workflows/npm.yml
+++ b/.github/workflows/npm.yml
@@ -4,14 +4,16 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read
-  id-token: write
+permissions: read-all
 
 jobs:
   build_and_publish:
     name: "Publish ccf-app package to NPM"
     runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
diff --git a/tests/ca_certs.py b/tests/ca_certs.py
index 208f3ed9527..9c2ff41775a 100644
--- a/tests/ca_certs.py
+++ b/tests/ca_certs.py
@@ -59,9 +59,9 @@ def test_cert_store(network, args):
         )
 
         stored_cert = json.loads(
-            network.get_ledger_public_state_at(set_proposal.completed_seqno)[
-                "public:ccf.gov.tls.ca_cert_bundles"
-            ][raw_cert_name]
+            network.get_ledger_public_state_at(
+                set_proposal.completed_seqno, timeout=10
+            )["public:ccf.gov.tls.ca_cert_bundles"][raw_cert_name]
         )
         cert_ref = cert_pem + cert2_pem
         assert (
@@ -72,7 +72,7 @@ def test_cert_store(network, args):
     remove_proposal = network.consortium.remove_ca_cert_bundle(primary, cert_name)
 
     assert (
-        network.get_ledger_public_state_at(remove_proposal.completed_seqno)[
+        network.get_ledger_public_state_at(remove_proposal.completed_seqno, timeout=10)[
             "public:ccf.gov.tls.ca_cert_bundles"
         ][raw_cert_name]
         is None
diff --git a/tests/programmability.py b/tests/programmability.py
index 3d63b418050..7af0236ee45 100644
--- a/tests/programmability.py
+++ b/tests/programmability.py
@@ -624,6 +624,7 @@ def run(args):
 
 if __name__ == "__main__":
     cr = ConcurrentRunner()
+    jwt_forwarding_timeout_ms = 10000
 
     cr.add(
         "programmability",
@@ -642,6 +643,7 @@ def run(args):
         nodes=infra.e2e_args.min_nodes(cr.args, f=1),
         jwt_key_refresh_interval_s=1,
         issuer_port=12345,
+        forwarding_timeout_ms=jwt_forwarding_timeout_ms,
     )
 
     cr.add(
@@ -651,6 +653,7 @@ def run(args):
         nodes=infra.e2e_args.min_nodes(cr.args, f=1),
         jwt_key_refresh_interval_s=100000,
         issuer_port=12346,
+        forwarding_timeout_ms=jwt_forwarding_timeout_ms,
     )
 
     cr.add(
@@ -658,6 +661,7 @@ def run(args):
         jwt_test.run_ca_cert,
         package="samples/apps/logging/logging",
         nodes=infra.e2e_args.max_nodes(cr.args, f=0),
+        forwarding_timeout_ms=jwt_forwarding_timeout_ms,
     )
 
     cr.run()