diff --git a/.github/workflows/build-and-push-bskyweb-aws.yaml b/.github/workflows/build-and-push-bskyweb-aws.yaml
index 66f53286ed..b537a482f1 100644
--- a/.github/workflows/build-and-push-bskyweb-aws.yaml
+++ b/.github/workflows/build-and-push-bskyweb-aws.yaml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
diff --git a/.github/workflows/build-and-push-bskyweb-ghcr.yaml b/.github/workflows/build-and-push-bskyweb-ghcr.yaml
index 65a3957f27..6ebfe5974e 100644
--- a/.github/workflows/build-and-push-bskyweb-ghcr.yaml
+++ b/.github/workflows/build-and-push-bskyweb-ghcr.yaml
@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
diff --git a/.github/workflows/build-and-push-embedr-aws.yaml b/.github/workflows/build-and-push-embedr-aws.yaml
index 10137741e1..d9dad03eb9 100644
--- a/.github/workflows/build-and-push-embedr-aws.yaml
+++ b/.github/workflows/build-and-push-embedr-aws.yaml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
diff --git a/.github/workflows/build-and-push-link-aws.yaml b/.github/workflows/build-and-push-link-aws.yaml
index 06d9a5573f..a01124601f 100644
--- a/.github/workflows/build-and-push-link-aws.yaml
+++ b/.github/workflows/build-and-push-link-aws.yaml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
diff --git a/.github/workflows/build-and-push-ogcard-aws.yaml b/.github/workflows/build-and-push-ogcard-aws.yaml
index 90d19bbd75..c84e0e2595 100644
--- a/.github/workflows/build-and-push-ogcard-aws.yaml
+++ b/.github/workflows/build-and-push-ogcard-aws.yaml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0
diff --git a/.github/workflows/build-submit-android.yml b/.github/workflows/build-submit-android.yml
index a5a57fd948..0381395a3e 100644
--- a/.github/workflows/build-submit-android.yml
+++ b/.github/workflows/build-submit-android.yml
@@ -31,6 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/build-submit-ios.yml b/.github/workflows/build-submit-ios.yml
index 2747fb0656..986116584e 100644
--- a/.github/workflows/build-submit-ios.yml
+++ b/.github/workflows/build-submit-ios.yml
@@ -31,6 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -96,10 +97,12 @@ jobs:
       - name: 🏗️ EAS Build
         env:
           PROFILE: ${{ inputs.profile || 'testflight' }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p ios
           --profile $PROFILE
diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml
index 8009853aa6..321b84caf9 100644
--- a/.github/workflows/bundle-deploy-eas-update.yml
+++ b/.github/workflows/bundle-deploy-eas-update.yml
@@ -51,6 +51,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: ⬇️ Fetch commits from base branch
         if: ${{ github.ref != 'refs/heads/main' }}
@@ -128,9 +129,12 @@ jobs:
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn export
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📦 Package Bundle and 🚀 Deploy
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
@@ -175,6 +179,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -234,12 +239,15 @@ jobs:
       - name: 🏗️ EAS Build
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p ios
           --profile testflight
           --local --output build.tar.gz --non-interactive
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📂 Extract build artifact
         run: |
@@ -323,6 +331,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -370,12 +379,15 @@ jobs:
       - name: 🏗️ EAS Build
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p android
           --profile testflight-android
           --local --output build.apk --non-interactive
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: ⏰ Get a timestamp
         id: timestamp
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 5558ae8c19..4a7da2d37e 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
diff --git a/.github/workflows/golang-test-lint.yml b/.github/workflows/golang-test-lint.yml
index beb486476f..0a6ab4f5f4 100644
--- a/.github/workflows/golang-test-lint.yml
+++ b/.github/workflows/golang-test-lint.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Git Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go tooling
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -33,6 +35,8 @@ jobs:
     steps:
       - name: Git Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go tooling
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 20c527ba09..71eb8f8bbf 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Verify Node version pins match .nvmrc
         run: |
           set -euo pipefail
@@ -64,6 +66,8 @@ jobs:
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/nightly-update-source-languages.yaml b/.github/workflows/nightly-update-source-languages.yaml
index efedfc06f8..ee97f37448 100644
--- a/.github/workflows/nightly-update-source-languages.yaml
+++ b/.github/workflows/nightly-update-source-languages.yaml
@@ -19,6 +19,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
+          persist-credentials: false
       - name: Install node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/pull-request-comment.yml b/.github/workflows/pull-request-comment.yml
index 560e7d383a..4d66d09485 100644
--- a/.github/workflows/pull-request-comment.yml
+++ b/.github/workflows/pull-request-comment.yml
@@ -116,6 +116,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ steps.pr-info.outputs.head-sha }}
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -173,9 +174,12 @@ jobs:
       - name: 🏗️ Create Bundle
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn export
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📦 Package Bundle and 🚀 Deploy
         run: yarn use-build-number bash scripts/bundleUpdate.sh
diff --git a/.github/workflows/pull-request-commit.yml b/.github/workflows/pull-request-commit.yml
index deb3b75659..984c9fc632 100644
--- a/.github/workflows/pull-request-commit.yml
+++ b/.github/workflows/pull-request-commit.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -111,6 +112,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 100
+          persist-credentials: false
 
       - name: ⬇️ Fetch commits from base branch
         run: git fetch origin main:main --depth 100
diff --git a/.github/workflows/sync-internal.yaml b/.github/workflows/sync-internal.yaml
index 3083e4d9ce..25036d1fac 100644
--- a/.github/workflows/sync-internal.yaml
+++ b/.github/workflows/sync-internal.yaml
@@ -13,6 +13,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Generate GitHub App Token
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
diff --git a/.github/workflows/verify-yarn-lock.yml b/.github/workflows/verify-yarn-lock.yml
index d331c55de7..5ea8265da8 100644
--- a/.github/workflows/verify-yarn-lock.yml
+++ b/.github/workflows/verify-yarn-lock.yml
@@ -15,6 +15,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Fetch base branch
         env: