diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml
index 1a6f2ec..ab1ac49 100644
--- a/.github/workflows/no-response.yml
+++ b/.github/workflows/no-response.yml
@@ -21,7 +21,9 @@ jobs:
     steps:
       - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
         with:
+          # Don't automatically mark inactive issues+PRs as stale.
           days-before-stale: -1
+          # Close needs-info issues and PRs after 14 days of inactivity.
           days-before-close: 14
           stale-issue-label: "needs-info"
           close-issue-message: >
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index fcb7ccb..27157a0 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -6,9 +6,12 @@ on:
   pull_request:
     branches: [ master ]
   push:
-    tags: [ 'v[0-9]+.[0-9]+.[0-9]+*' ]
+    tags: [ 'v[0-9]+.[0-9]+.[0-9]+' ]
 
 jobs:
   publish:
     if: ${{ github.repository_owner == 'dart-lang' }}
     uses: dart-lang/ecosystem/.github/workflows/publish.yaml@main
+    permissions:
+      id-token: write # Required for authentication using OIDC
+      pull-requests: write # Required for writing the pull request note
diff --git a/.github/workflows/test-package.yml b/.github/workflows/test-package.yml
index 1f9161b..1535d97 100644
--- a/.github/workflows/test-package.yml
+++ b/.github/workflows/test-package.yml
@@ -22,7 +22,7 @@ jobs:
         sdk: [stable]
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: dart-lang/setup-dart@b64355ae6ca0b5d484f0106a033dd1388965d06d
+      - uses: dart-lang/setup-dart@ca7e6fee45ffbd82b555a7ebfc236d2c86439f5b
         with:
           sdk: ${{ matrix.sdk }}
       - id: install
@@ -47,7 +47,7 @@ jobs:
         sdk: [2.19.0, stable, beta]
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: dart-lang/setup-dart@b64355ae6ca0b5d484f0106a033dd1388965d06d
+      - uses: dart-lang/setup-dart@ca7e6fee45ffbd82b555a7ebfc236d2c86439f5b
         with:
           sdk: ${{ matrix.sdk }}
       - id: install