diff --git a/.github/workflows/publish-test.yaml b/.github/workflows/publish-test.yaml
index 69e235a..8df8dc3 100644
--- a/.github/workflows/publish-test.yaml
+++ b/.github/workflows/publish-test.yaml
@@ -10,6 +10,7 @@ jobs:
       matrix:
         python-version: [ "3.10" ]
     permissions:
+      contents: read
       id-token: write
     steps:
       - uses: actions/checkout@v4
@@ -23,7 +24,7 @@ jobs:
           pdm install --global --project .
       - name: publish
         run: |
-          pdm publish --repository https://test.pypi.org/legacy/
+          pdm publish --repository testpypi
 
 
   publish-docs:
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 9931dd9..c5acc0e 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -11,6 +11,7 @@ jobs:
       matrix:
         python-version: [ "3.10" ]
     permissions:
+      contents: read
       id-token: write
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/release-staging.yaml b/.github/workflows/release-staging.yaml
index 82d545c..fbd9f1d 100644
--- a/.github/workflows/release-staging.yaml
+++ b/.github/workflows/release-staging.yaml
@@ -17,6 +17,7 @@ jobs:
   publish:
     name: Publish staging release
     permissions:
+      contents: read
       id-token: write
       pages: write
     uses: ./.github/workflows/publish-test.yaml
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f993628..374e3a9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -9,5 +9,6 @@ jobs:
   publish:
     name: Publish release
     permissions:
+      contents: read
       id-token: write
     uses: ./.github/workflows/publish.yaml