diff --git a/.github/workflows/daily-update.yml b/.github/workflows/daily-update.yml
index 192b0b8..340827c 100644
--- a/.github/workflows/daily-update.yml
+++ b/.github/workflows/daily-update.yml
@@ -15,16 +15,25 @@ concurrency:
 jobs:
   update:
     runs-on: ubuntu-24.04
+    # The bot's key and BBOT_IO_API_KEY live only in this environment, which
+    # accepts the stable branch only, so no other branch, pull request or
+    # dispatched copy of this workflow can read them.
+    environment: data-update
+    # The push uses the App token below, not GITHUB_TOKEN.
     permissions:
-      contents: write
+      contents: read
 
     steps:
     - name: Generate app token
       id: app-token
       uses: actions/create-github-app-token@v3
       with:
-        app-id: ${{ secrets.CLOUDCHECK_APP_ID }}
+        app-id: ${{ vars.CLOUDCHECK_APP_ID }}
         private-key: ${{ secrets.CLOUDCHECK_APP_PRIVATE_KEY }}
+        # Only contents write: the most the bot needs. With no owner or
+        # repositories input, the token covers only this repository; setting
+        # owner alone would widen it to every repository in the installation.
+        permission-contents: write
 
     - name: Checkout stable branch
       uses: actions/checkout@v7
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index a618029..5249878 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -47,19 +47,17 @@ jobs:
     runs-on: ubuntu-24.04
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
+    # The tag push uses GITHUB_TOKEN, not the bot's key: the PR rule on stable
+    # applies to GITHUB_TOKEN, so this job can't push to stable.
     permissions:
       contents: write
     steps:
-      - name: Generate app token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.CLOUDCHECK_APP_ID }}
-          private-key: ${{ secrets.CLOUDCHECK_APP_PRIVATE_KEY }}
+      # No credentials left in .git/config, so the build steps below (third-party
+      # build code) can't push. Only the tag step gets the token.
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -90,11 +88,13 @@ jobs:
         run: uv run maturin publish --skip-existing --username __token__ --password ${{ secrets.PYPI_TOKEN }}
       - name: Tag release
         if: steps.version_check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git tag -a "${{ steps.get_version.outputs.VERSION }}" -m "Release ${{ steps.get_version.outputs.VERSION }}"
-          git push origin "refs/tags/${{ steps.get_version.outputs.VERSION }}"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${{ steps.get_version.outputs.VERSION }}"
   linux:
     runs-on: ${{ matrix.platform.runner }}
     needs: publish