diff --git a/.github/PklProject b/.github/PklProject
index ab2f074..422adbd 100644
--- a/.github/PklProject
+++ b/.github/PklProject
@@ -18,7 +18,7 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.3"
   }
   ["gha"] {
     uri = "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.6"
diff --git a/.github/PklProject.deps.json b/.github/PklProject.deps.json
index 53cb0d2..ac09a6d 100644
--- a/.github/PklProject.deps.json
+++ b/.github/PklProject.deps.json
@@ -10,9 +10,9 @@
     },
     "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.1",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@0.7.3",
       "checksums": {
-        "sha256": "f8efc4b174855a2fafdab8ed792de4b0cb89b0516d688c8540eea13af20e0f80"
+        "sha256": "43373b62e12e46a24d7d0c98c4eb76042ab9a0e9cd7d42476c960be5b211d4bd"
       }
     }
   }
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d896671..312afcb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -21,6 +21,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
+        persist-credentials: false
         fetch-depth: 0
     - run: hawkeye check --config licenserc.toml --fail-if-unknown
     container:
@@ -30,6 +31,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
@@ -51,6 +54,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a6c93c7..1c5da6b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,6 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
+        persist-credentials: false
         fetch-depth: 0
     - run: hawkeye check --config licenserc.toml --fail-if-unknown
     container:
@@ -29,6 +30,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
@@ -50,6 +53,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
diff --git a/.github/workflows/prb.yml b/.github/workflows/prb.yml
index 189f205..448e6a2 100644
--- a/.github/workflows/prb.yml
+++ b/.github/workflows/prb.yml
@@ -16,6 +16,7 @@ jobs:
     steps:
     - uses: actions/checkout@v5
       with:
+        persist-credentials: false
         fetch-depth: 0
     - run: hawkeye check --config licenserc.toml --fail-if-unknown
     container:
@@ -25,6 +26,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
@@ -46,6 +49,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env:
@@ -74,6 +79,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Setup Pkl
       id: setup-pkl
       env: