diff --git a/.github/workflows/bat.yml b/.github/workflows/bat.yml
index 4a3640c..103fb59 100644
--- a/.github/workflows/bat.yml
+++ b/.github/workflows/bat.yml
@@ -1,13 +1,15 @@
 name: Build and Test
 on: [push]
+permissions:
+  contents: read
 
 jobs:
   bat:
     name: Build and Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 20
       - name: Perform npm tasks
@@ -65,7 +67,7 @@ jobs:
             check-matlab: matlabVer = ver('matlab'); assert(strcmp(matlabVer.Release,'(R2023a)'));
             check-toolbox: symbolicVer = ver('symbolic'); assert(strcmp(symbolicVer.Release,'(R2023a)'));
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           name: built-action
       - name: Install selected products
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e904661..7a97572 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,8 +1,9 @@
 name: Publish
-
 on:
   release:
-    types: [published, edited]
+    types: published
+permissions:
+  contents: write
 
 jobs:
   build:
@@ -11,15 +12,12 @@ jobs:
     outputs:
       tag: ${{ steps.update-package-version.outputs.version }}
     steps:
-      # Configure runner with the right stuff
-      - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v5
       - name: Configure git
         run: |
           git config user.name 'Release Action'
           git config user.email '<>'
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v5
         with:
           node-version: 20
 
@@ -31,7 +29,6 @@ jobs:
         run: |
           git tag -d "${{ github.event.release.tag_name }}"
           VERSION=$(npm version "${{ github.event.release.tag_name }}" --no-git-tag-version)
-          echo "::set-output name=version::$VERSION"
           git add package.json package-lock.json
           git commit -m "[skip ci] Bump $VERSION"
           git push origin HEAD:main
@@ -47,8 +44,8 @@ jobs:
         id: release_info
         run: |
           # Check for semantic versioning
-          echo "Preparing release for version $longVersion"
           longVersion="${{github.event.release.tag_name}}"
+          echo "Preparing release for version $longVersion"
           [[ $longVersion == v[0-9]*.[0-9]*.[0-9]* ]]  || (echo "must follow semantic versioning" && exit 1)
           majorVersion=$(echo ${longVersion%.*.*})
           minorVersion=$(echo ${longVersion%.*})