diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 71ffac3..0c0c635 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -25,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -51,6 +55,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index bf069d7..f0a42f8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/refresh-bettertls-testcases.yml b/.github/workflows/refresh-bettertls-testcases.yml
index 5ac615a..4bb0c14 100644
--- a/.github/workflows/refresh-bettertls-testcases.yml
+++ b/.github/workflows/refresh-bettertls-testcases.yml
@@ -18,6 +18,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
@@ -31,6 +33,7 @@ jobs:
           repository: Netflix/bettertls
           ref: master
           path: bettertls
+          persist-credentials: false
 
       - name: Build BetterTLS JSON
         run: |
diff --git a/.github/workflows/refresh-online-testcases.yml b/.github/workflows/refresh-online-testcases.yml
index 6bf0831..7a01d8c 100644
--- a/.github/workflows/refresh-online-testcases.yml
+++ b/.github/workflows/refresh-online-testcases.yml
@@ -15,6 +15,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index b2b1585..dba5aa2 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index c869caf..beb1f83 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with: