diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7a7b1d79c4..9514ffb0a8 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,10 +1,6 @@
 #
 # Learn about membership in OpenTelemetry community:
-# https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
-#
-#
-# Learn about CODEOWNERS file format:
-#  https://help.github.com/en/articles/about-code-owners
+#  https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
 #
 
 * @open-telemetry/java-contrib-approvers
diff --git a/.github/config/lychee.toml b/.github/config/lychee.toml
index 071c66fd81..70986bfb44 100644
--- a/.github/config/lychee.toml
+++ b/.github/config/lychee.toml
@@ -1,3 +1,6 @@
+# Lychee configuration file
+# See https://lychee.cli.rs/config/
+
 timeout = 30
 retry_wait_time = 5
 max_retries = 6
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1820bd005c..355f4731a0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - release/*
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index d2e124e7d6..3c8e7592af 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -2,9 +2,6 @@ name: Gradle wrapper validation
 
 on:
   push:
-    branches:
-      - main
-      - release/*
   pull_request:
   merge_group:
 
@@ -17,4 +14,5 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 5b35ab605f..15405b2768 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -8,7 +8,8 @@ on:
     - cron: "43 6 * * 5" # weekly at 06:43 (UTC) on Friday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
diff --git a/.github/workflows/owasp-dependency-check-daily.yml b/.github/workflows/owasp-dependency-check-daily.yml
index 6425536bed..6b20eeba37 100644
--- a/.github/workflows/owasp-dependency-check-daily.yml
+++ b/.github/workflows/owasp-dependency-check-daily.yml
@@ -4,8 +4,7 @@ name: OWASP dependency check (daily)
 
 on:
   schedule:
-    # daily at 1:30 UTC
-    - cron: "30 1 * * *"
+    - cron: "30 1 * * *" # daily at 1:30 UTC
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 58c5dc8bbc..5834e2d6d4 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -25,7 +25,7 @@ jobs:
 
   create-pull-request-against-release-branch:
     permissions:
-      contents: write  # for Git to git push
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     needs:
       - prereqs
@@ -82,7 +82,7 @@ jobs:
 
   create-pull-request-against-main:
     permissions:
-      contents: write  # for Git to git push
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     needs:
       - prereqs
diff --git a/.github/workflows/reusable-misspell-check.yml b/.github/workflows/reusable-misspell-check.yml
index 7e8ddaf772..56df663353 100644
--- a/.github/workflows/reusable-misspell-check.yml
+++ b/.github/workflows/reusable-misspell-check.yml
@@ -14,9 +14,7 @@ jobs:
 
       - name: Install misspell
         run: |
-          curl -L -o install-misspell.sh \
-               https://raw.githubusercontent.com/client9/misspell/master/install-misspell.sh
-          sh ./install-misspell.sh
+          curl -sfL https://raw.githubusercontent.com/golangci/misspell/master/install-misspell.sh | sh -s -- -b bin
 
       - name: Run misspell
         run: bin/misspell -error .