diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9cd2539..e4bb34a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,13 +43,15 @@ jobs:
     uses: ./.github/workflows/test.yml
     permissions:
       contents: read
-    secrets: inherit
+    secrets:
+      CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
 
   docs:
     needs: prep-release
     uses: ./.github/workflows/docs.yml
     permissions:
       contents: write
-    secrets: inherit
+    secrets:
+      GH_DFETCH_ORG_DEPLOY: ${{ secrets.GH_DFETCH_ORG_DEPLOY }}
     with:
       release_id: ${{ needs.prep-release.outputs.release_id }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d0d90d0b..92e1576d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -7,6 +7,9 @@ on:
         required: false
         type: string
         default: ''
+    secrets:
+      GH_DFETCH_ORG_DEPLOY:
+        required: false
 
 permissions:
   contents: read
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c79ad341..667cdf61 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,9 @@ name: Test
 
 on:
   workflow_call:
+    secrets:
+      CODACY_PROJECT_TOKEN:
+        required: false
 
 permissions:
   contents: read