diff --git a/.github/workflows/__main-ci.yml b/.github/workflows/__main-ci.yml
index fbd15af3..839245f4 100644
--- a/.github/workflows/__main-ci.yml
+++ b/.github/workflows/__main-ci.yml
@@ -11,15 +11,7 @@ on: # yamllint disable-line rule:truthy
   schedule:
     - cron: "25 8 * * 1"
 
-permissions:
-  actions: read
-  contents: read
-  deployments: write
-  pages: write
-  security-events: write
-  statuses: write
-  # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
-  id-token: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -28,14 +20,34 @@ concurrency:
 jobs:
   ci:
     uses: ./.github/workflows/__shared-ci.yml
+    permissions:
+      actions: read
+      contents: read
+      deployments: write
+      security-events: write
+      statuses: write
     secrets: inherit
 
   release:
     needs: ci
     if: github.event_name != 'schedule'
     uses: ./.github/workflows/release-actions.yml
+    permissions:
+      contents: read
     with:
       update-all: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || github.event_name == 'workflow_dispatch' }}
       github-app-id: ${{ vars.CI_BOT_APP_ID }}
     secrets:
       github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
+
+  sync-docs:
+    needs: release
+    if: github.event_name != 'schedule' && github.ref_name != github.event.repository.default_branch && needs.release.outputs.artifact-id
+    uses: hoverkraft-tech/public-docs/.github/workflows/sync-docs-dispatcher.yml@c40c17f7d6a8090950b3ef4bfc70502707a6bb9f # 0.3.0
+    permissions:
+      contents: read
+    with:
+      artifact-id: ${{ needs.release.outputs.artifact-id }}
+      github-app-id: ${{ vars.CI_BOT_APP_ID }}
+    secrets:
+      github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml
index ea989a28..297513d4 100644
--- a/.github/workflows/__shared-ci.yml
+++ b/.github/workflows/__shared-ci.yml
@@ -18,6 +18,7 @@ jobs:
   test-action-check-url-lighthouse:
     needs: linter
     uses: ./.github/workflows/__test-action-check-url-lighthouse.yml
+
   test-action-check-url-ping:
     needs: linter
     uses: ./.github/workflows/__test-action-check-url-ping.yml