diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 839fd4b57..53dfed2f2 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -14,7 +14,7 @@ permissions:
   # leaving this out makes GitHub reject the run at startup_failure with zero
   # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
   actions: read
-  contents: write
+  contents: read
   pull-requests: write
 
 jobs:
diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml
index 48eb17abe..aee3aed48 100644
--- a/.github/workflows/codeql-reusable.yml
+++ b/.github/workflows/codeql-reusable.yml
@@ -89,6 +89,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
index 35983b659..31e940ebe 100644
--- a/.github/workflows/hypatia-scan-reusable.yml
+++ b/.github/workflows/hypatia-scan-reusable.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Elixir for Hypatia scanner
         uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml
index ef8408de3..ba51d78ed 100644
--- a/.github/workflows/readme-derive.yml
+++ b/.github/workflows/readme-derive.yml
@@ -24,7 +24,7 @@ permissions:
   # leaving this out makes GitHub reject the run at startup_failure with zero
   # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'".
   actions: read
-  contents: write
+  contents: read
 
 jobs:
   derive:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
deleted file mode 100644
index acf3bf45e..000000000
--- a/.github/workflows/rust-ci.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# This workflow is managed by gh actions-lock.
-name: Rust CI
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  ci:
-    uses: ./.github/workflows/rust-ci-reusable.yml
diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml
index 9e13cbfc9..675ae0655 100644
--- a/.github/workflows/signed-push-smoke.yml
+++ b/.github/workflows/signed-push-smoke.yml
@@ -14,7 +14,7 @@ concurrency:
   group: ${{ github.workflow }}
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   smoke:
@@ -23,6 +23,8 @@ jobs:
     # job that `uses:` a reusable workflow — it is an illegal key there and
     # GitHub refuses to parse the ENTIRE file, killing every job in it.
     timeout-minutes: 10
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/config/rulesets/Immutable-Tags.json b/config/rulesets/Immutable-Tags.json
new file mode 100644
index 000000000..53739afe3
--- /dev/null
+++ b/config/rulesets/Immutable-Tags.json
@@ -0,0 +1,19 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "creation"},
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}
diff --git a/config/rulesets/Optimus-Branch.json b/config/rulesets/Optimus-Branch.json
new file mode 100644
index 000000000..03ad48821
--- /dev/null
+++ b/config/rulesets/Optimus-Branch.json
@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}