diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 3958600b2c..2c08c4d78c 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -27,6 +27,7 @@ on:
           - prerelease
 
 permissions:
+  id-token: none
   contents: write
 
 jobs:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index fb84f17a4a..00d19b767f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,6 +25,7 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      id-token: none
       actions: read
       contents: read
       security-events: write
diff --git a/.github/workflows/headers.yml b/.github/workflows/headers.yml
index b6ae879c1a..7cc750b472 100644
--- a/.github/workflows/headers.yml
+++ b/.github/workflows/headers.yml
@@ -6,6 +6,7 @@ on:
     - cron: "0 0 * * 0" # Runs every Sunday at midnight UTC
 
 permissions:
+  id-token: none
   contents: write # Grants write access to push changes
   pull-requests: write # and create PRs
 
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index a5f88fc2ba..049818a999 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -9,6 +9,10 @@ on:
   pull_request:
     branches: [ master, v25, v26, v27 ]
 
+permissions:
+  id-token: none
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/express-zod-api/package.json b/express-zod-api/package.json
index 24d1fb02fc..3cf7c0294f 100644
--- a/express-zod-api/package.json
+++ b/express-zod-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-zod-api",
-  "version": "28.0.1-beta.0",
+  "version": "28.0.1-beta.1",
   "description": "A Typescript framework to help you get an API server up and running with I/O schema validation and custom middlewares in minutes.",
   "license": "MIT",
   "repository": {
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 77f445e53e..716840915c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,6 +11,7 @@ gitChecks: false
 engineStrict: true
 autoInstallPeers: false
 dedupePeers: true
+minimumReleaseAge: 10080
 publicHoistPattern:
   - "@typescript-eslint/*" # used as an assumed transitive in migration
   - "@vitest/*" # used by vitest.setup.ts and vitest.config.ts
diff --git a/renovate.json b/renovate.json
index 9e01e95458..b859d079e8 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,7 +4,7 @@
   "dependencyDashboard": false,
   "postUpdateOptions": ["pnpmDedupe"],
   "ignorePaths": ["**/compat-test/**"],
-  "minimumReleaseAge": "1 day",
+  "minimumReleaseAge": "7 days",
   "packageRules": [
     {
       "groupName": "TypeScript-ESLint and its rule tester",