diff --git a/.github/workflows/check_links.yml b/.github/workflows/check_links.yml
index 45893ef..3e4bf06 100644
--- a/.github/workflows/check_links.yml
+++ b/.github/workflows/check_links.yml
@@ -8,6 +8,8 @@ on:
 
 jobs:
   linkChecker:
+    permissions:
+      issues: write # required for peter-evans/create-issue-from-file
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -16,7 +18,6 @@ jobs:
         id: lychee
         uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2.3.0
         with:
-          token: ${{ secrets.GH_TOKEN }}
           fail: false
 
       - name: Create Issue From File
@@ -26,4 +27,3 @@ jobs:
           title: Link Checker Report
           content-filepath: ./lychee/out.md
           labels: report, automated issue
-          token: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/gorelease.yml b/.github/workflows/gorelease.yml
index c625ece..45a00e8 100644
--- a/.github/workflows/gorelease.yml
+++ b/.github/workflows/gorelease.yml
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - v\d+\.\d+\.\d+
+  workflow_dispatch:
 
 jobs:
   goreleaser:
@@ -25,3 +26,5 @@ jobs:
           distribution: goreleaser
           version: '~> v2'
           args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/replace_version.yml b/.github/workflows/replace_version.yml
index c6b2736..12acada 100644
--- a/.github/workflows/replace_version.yml
+++ b/.github/workflows/replace_version.yml
@@ -7,13 +7,11 @@ on:
 jobs:
   replace_version:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.SVC_PAT }}
           ref: main
 
       - name: Replace image version in k8s manifests