diff --git a/.github/workflows/create-github-release.yml b/.github/workflows/create-github-release.yml
index e655c9a..8630cd5 100644
--- a/.github/workflows/create-github-release.yml
+++ b/.github/workflows/create-github-release.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and release on GitHub
-        uses: "marvinpinto/action-automatic-releases@1.2.1"
+        uses: "marvinpinto/action-automatic-releases@v1.2.1"
         with:
           repo_token: "${{ secrets.GITHUB_TOKEN }}"
-          prerelease: true # change this back once tested
+          prerelease: false
diff --git a/.github/workflows/create-pypi-release.yml b/.github/workflows/create-pypi-release.yml
index 2aca811..4d11d12 100644
--- a/.github/workflows/create-pypi-release.yml
+++ b/.github/workflows/create-pypi-release.yml
@@ -9,6 +9,8 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
       - name: Build and publish to PyPI
         uses: JRubics/poetry-publish@v1.17
         with:
diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index 45f8b58..7fcd7da 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           ref: dev
       - name: Install Python
diff --git a/.github/workflows/tag-version-commit.yml b/.github/workflows/tag-version-commit.yml
index f746f6f..2b48a5f 100644
--- a/.github/workflows/tag-version-commit.yml
+++ b/.github/workflows/tag-version-commit.yml
@@ -7,10 +7,11 @@ on:
 
 jobs:
   tag:
+    permissions: write-all
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v2
+      - name: Check out repository code
+        uses: actions/checkout@v4
       - name: Generate tag
         uses: christophebedard/tag-version-commit@v1
         with: