diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f1cb643..cd489a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,7 @@
 name: CI
 
+permissions: {}
+
 on:
   workflow_dispatch: {}
   pull_request:
@@ -18,11 +20,11 @@ jobs:
       matrix:
         include:
           - container: alpine:latest
-            preinstall: apk add bash coreutils curl git
+            preinstall: apk add bash coreutils curl git jq
           - container: centos:latest
-            preinstall: dnf -y --disablerepo '*' --enablerepo=extras swap centos-linux-repos centos-stream-repos && dnf -y install git
+            preinstall: dnf -y --disablerepo '*' --enablerepo=extras swap centos-linux-repos centos-stream-repos && dnf -y install git jq
           - container: ubuntu:latest
-            preinstall: apt-get -y update && apt-get -y install curl git
+            preinstall: apt-get -y update && apt-get -y install curl git jq
 
     runs-on: ubuntu-latest
 
@@ -37,12 +39,19 @@ jobs:
         uses: asdf-vm/actions/plugin-test@v1
         with:
           command: assume --version; granted --version
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
 
   macos:
     runs-on: macos-latest
 
     steps:
+      - name: Preinstall
+        run: brew install jq
+
       - name: Test plugin
         uses: asdf-vm/actions/plugin-test@v1
         with:
           command: assume --version; granted --version
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/trunk.yml b/.github/workflows/trunk.yml
index ddc7f6c..049af1a 100644
--- a/.github/workflows/trunk.yml
+++ b/.github/workflows/trunk.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Trunk Check
         uses: trunk-io/trunk-action@v1
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..8a1648c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+?.*
+.vscode
diff --git a/.trunk/.gitignore b/.trunk/.gitignore
index 8130ba6..1e24652 100644
--- a/.trunk/.gitignore
+++ b/.trunk/.gitignore
@@ -2,7 +2,7 @@
 *logs
 *actions
 *notifications
+*tools
 plugins
 user_trunk.yaml
 user.yaml
-shims
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 7989857..2565c18 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -1,19 +1,23 @@
 version: 0.1
 cli:
-  version: 1.9.1
+  version: 1.16.2
 lint:
+  disabled:
+    - checkov
+    - trivy
+    - trufflehog
   enabled:
-    - actionlint@1.6.24
+    - actionlint@1.6.26
     - git-diff-check
-    - gitleaks@8.16.3
-    - markdownlint@0.34.0
-    - prettier@2.8.8
+    - gitleaks@8.18.0
+    - markdownlint@0.37.0
+    - prettier@3.0.3
     - shellcheck@0.9.0
-    - shfmt@3.5.0
-    - yamllint@1.31.0
+    - shfmt@3.6.0
+    - yamllint@1.32.0
 runtimes:
   enabled:
-    - go@1.19.5
+    - go@1.21.0
     - node@18.12.1
     - python@3.10.8
 actions:
@@ -25,5 +29,5 @@ actions:
 plugins:
   sources:
     - id: trunk
-      ref: v0.0.17
+      ref: v1.2.5
       uri: https://github.com/trunk-io/plugins
diff --git a/bin/install b/bin/install
index 735d032..94e8d5a 100755
--- a/bin/install
+++ b/bin/install
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 
 set -euo pipefail
+shopt -s inherit_errexit 2>/dev/null || true
 
 [[ -z ${ASDF_INSTALL_TYPE+x} ]] && echo "ASDF_INSTALL_TYPE is required" && exit 1
 [[ -z ${ASDF_INSTALL_VERSION+x} ]] && echo "ASDF_INSTALL_VERSION is required" && exit 1
@@ -16,7 +17,7 @@ install() {
 
 	local tmp_download_dir
 
-	if [[ -z ${TMPDIR:-} ]]; then
+	if [[ -z ${TMPDIR-} ]]; then
 		tmp_download_dir=$(mktemp -d)
 	else
 		tmp_download_dir=${TMPDIR%/}
@@ -37,7 +38,7 @@ install() {
 	local download_filename="granted_${version}_${platform}_${arch}.tar.gz"
 	local download_url="https://releases.commonfate.io/granted/${prefix}${version}/${download_filename}"
 
-	echo "Downloading from ${download_url}"
+	echo "Downloading ${download_filename} from release ${prefix}${version} from ${download_url}"
 
 	pushd "${tmp_download_dir}" >/dev/null
 
diff --git a/bin/list-all b/bin/list-all
index ccdf2a6..7890b1e 100755
--- a/bin/list-all
+++ b/bin/list-all
@@ -4,8 +4,10 @@ set -euo pipefail
 shopt -s inherit_errexit 2>/dev/null || true
 
 function gh_curl() {
-	if [[ -n ${GITHUB_TOKEN:-} ]]; then
+	if [[ -n ${GITHUB_TOKEN-} ]]; then
 		curl -s -H "Authorization: token ${GITHUB_TOKEN}" "$@"
+	elif [[ -n ${GITHUB_API_TOKEN-} ]]; then
+		curl -s -H "Authorization: token ${GITHUB_API_TOKEN}" "$@"
 	else
 		curl -s "$@"
 	fi