diff --git a/.github/workflows/.deployer.yml b/.github/workflows/.deployer.yml
index 75e093e..94630a4 100644
--- a/.github/workflows/.deployer.yml
+++ b/.github/workflows/.deployer.yml
@@ -108,7 +108,7 @@ jobs:
       - name: Resolve PR from images
         id: tracker
         if: inputs.tag == '' && inputs.promote_images != ''
-        uses: bcgov/actions/image-tracker@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/image-tracker@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           packages: ${{ inputs.promote_images }}
 
@@ -200,7 +200,7 @@ jobs:
           persist-credentials: false
 
       # One call: resolve every package's digest and point promote_tags at it
-      - uses: bcgov/actions/image-tracker@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      - uses: bcgov/actions/image-tracker@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           packages: ${{ inputs.promote_images }}
           tags: ${{ inputs.promote_tags }}
diff --git a/.github/workflows/cert-expiry-tests.yml b/.github/workflows/cert-expiry-tests.yml
index 26690b5..bc3d413 100644
--- a/.github/workflows/cert-expiry-tests.yml
+++ b/.github/workflows/cert-expiry-tests.yml
@@ -46,7 +46,7 @@ jobs:
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - id: diff
-        uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           base: ${{ steps.base.outputs.sha || github.event.before }}
           triggers: |
@@ -139,10 +139,13 @@ jobs:
       - unit
       - known-host
     if: always()
-    permissions: {}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
-      - uses: bcgov/actions/workflow-results@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      - uses: bcgov/actions/workflow-results@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           needs: ${{ toJson(needs) }}
diff --git a/.github/workflows/oc-runner-commands.yml b/.github/workflows/oc-runner-commands.yml
index 751ce44..e3451b6 100644
--- a/.github/workflows/oc-runner-commands.yml
+++ b/.github/workflows/oc-runner-commands.yml
@@ -39,7 +39,7 @@ jobs:
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - id: diff
-        uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           base: ${{ steps.base.outputs.sha || github.event.before }}
           triggers: |
@@ -119,10 +119,13 @@ jobs:
       - commands
       - unreachable-api
     if: always()
-    permissions: {}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
-      - uses: bcgov/actions/workflow-results@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      - uses: bcgov/actions/workflow-results@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           needs: ${{ toJson(needs) }}
diff --git a/.github/workflows/pg-upgrade.yml b/.github/workflows/pg-upgrade.yml
index 591abcd..49e6588 100644
--- a/.github/workflows/pg-upgrade.yml
+++ b/.github/workflows/pg-upgrade.yml
@@ -44,7 +44,7 @@ jobs:
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - id: diff
-        uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           base: ${{ steps.base.outputs.sha || github.event.before }}
           # pg-upgrade/action.yml calls oc-runner only to log in
@@ -132,10 +132,13 @@ jobs:
       - unit
       - containers
     if: always()
-    permissions: {}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
-      - uses: bcgov/actions/workflow-results@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      - uses: bcgov/actions/workflow-results@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           needs: ${{ toJson(needs) }}
diff --git a/.github/workflows/pr-open.yml b/.github/workflows/pr-open.yml
index 36b0715..ceb14c4 100644
--- a/.github/workflows/pr-open.yml
+++ b/.github/workflows/pr-open.yml
@@ -138,7 +138,7 @@ jobs:
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - id: diff
-        uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           base: ${{ steps.base.outputs.sha || github.event.before }}
           filters: |
@@ -263,7 +263,7 @@ jobs:
           echo "sha=${sha}" >> "$GITHUB_OUTPUT"
 
       - id: diff
-        uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+        uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           base: ${{ steps.base.outputs.sha || github.event.before }}
           triggers: |
@@ -687,10 +687,13 @@ jobs:
       - test-fork-token-degradation
       - test-image-import
     if: always()
-    permissions: {}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
-      - uses: bcgov/actions/workflow-results@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      - uses: bcgov/actions/workflow-results@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
         with:
           needs: ${{ toJson(needs) }}
diff --git a/crunchy/action.yml b/crunchy/action.yml
index 396a744..ab21603 100644
--- a/crunchy/action.yml
+++ b/crunchy/action.yml
@@ -282,7 +282,7 @@ runs:
         echo "VALUES_URL=${VALUES_URL}" >> $GITHUB_ENV
 
     - id: triggers
-      uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
       with:
         triggers: ${{ inputs.triggers }}
         base: ${{ inputs.base }}
diff --git a/deployer/action.yml b/deployer/action.yml
index 898664e..26445af 100644
--- a/deployer/action.yml
+++ b/deployer/action.yml
@@ -133,7 +133,7 @@ runs:
 
     # Send triggers to diff action
     - id: triggers
-      uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
       with:
         triggers: ${{ inputs.triggers }}
         base: ${{ inputs.base }}
diff --git a/oc-runner/action.yml b/oc-runner/action.yml
index 92ada47..7017675 100644
--- a/oc-runner/action.yml
+++ b/oc-runner/action.yml
@@ -133,7 +133,7 @@ runs:
 
     # Send triggers to diff action
     - id: diff
-      uses: bcgov/actions/diff-triggers@8843560d44aa717798dacb6831bf87161d0658ca # v0.11.0
+      uses: bcgov/actions/diff-triggers@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
       with:
         triggers: ${{ inputs.triggers }}
         base: ${{ inputs.base }}