diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 6e21ec0..ccafec1 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -7,10 +7,16 @@ on:
       - main
       - gh-pages
 
+permissions: {}
+
 jobs:
   pre-commit:
+    permissions:
+      contents: read
     uses: radiorabe/actions/.github/workflows/test-pre-commit.yaml@5dafb461cea1f8b296d89297dc6de7bd0891f0d2 # v0.44.2
   pytest:
+    permissions:
+      contents: read
     uses: radiorabe/actions/.github/workflows/test-python-poetry.yaml@5dafb461cea1f8b296d89297dc6de7bd0891f0d2 # v0.44.2
   github-actions:
     permissions:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6018949..fdc2c2e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -7,10 +7,22 @@ on:
   release:
     types: [created]
 
+permissions: {}
+
 jobs:
   python-poetry:
     permissions:
-      contents: write # Required to push the gh-pages branch for documentation deployment
+      contents: write # for publishing gh-pages with mkdocs (unused)
     uses: radiorabe/actions/.github/workflows/release-python-poetry.yaml@5dafb461cea1f8b296d89297dc6de7bd0891f0d2 # v0.44.2
+    with:
+      deploy-mkdocs: false
     secrets:
       RABE_PYPI_TOKEN: ${{ secrets.RABE_PYPI_TOKEN }}
+  release-docs:
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    uses: radiorabe/actions/.github/workflows/release-zensical.yaml@5dafb461cea1f8b296d89297dc6de7bd0891f0d2 # v0.44.2
+    with:
+      requirements: mkdocstrings mkdocstrings-python
diff --git a/.github/workflows/semantic-release.yaml b/.github/workflows/semantic-release.yaml
index fc9dec2..bd2ee03 100644
--- a/.github/workflows/semantic-release.yaml
+++ b/.github/workflows/semantic-release.yaml
@@ -5,8 +5,12 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
-  call-workflow:
+  semantic-release:
+    permissions:
+      contents: read
     uses: radiorabe/actions/.github/workflows/semantic-release.yaml@5dafb461cea1f8b296d89297dc6de7bd0891f0d2 # v0.44.2
     secrets:
       RABE_ITREAKTION_GITHUB_TOKEN: ${{ secrets.RABE_ITREAKTION_GITHUB_TOKEN }}