diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c4bd3aa..5410223 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,7 +5,7 @@ updates:
     schedule:
       interval: 'monthly'
     groups:
-      all-dependencies:
+      actions:
         patterns:
           - '*'
     commit-message:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a3a2f16..5f23808 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,14 +5,13 @@ on:
     tags:
       - 'v*.*.*'
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-
 jobs:
   publish:
     uses: stoe/policies/.github/workflows/policy-node-publish.yml@main
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     with:
       npm: true
       gh: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 00604ec..643f046 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,10 +7,9 @@ on:
     paths-ignore:
       - '*.md'
 
-permissions:
-  contents: read
-  packages: read
-
 jobs:
   test:
     uses: stoe/policies/.github/workflows/policy-node-test.yml@main
+    permissions:
+      contents: read
+      packages: read