diff --git a/.github/workflows/nb_tests.yml b/.github/workflows/nb_tests.yml
index 9efbd9ce..290d8424 100644
--- a/.github/workflows/nb_tests.yml
+++ b/.github/workflows/nb_tests.yml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout branch
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false 
       - uses: actions/setup-python@v5
         with:
           python-version: '3.10' 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1745b976..c7c470c0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,6 +19,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
@@ -82,18 +84,22 @@ jobs:
     - name: Create GitHub Release
       env:
         GITHUB_TOKEN: ${{ github.token }}
+        REF_NAME: ${{ github.ref_name }}
+        REPOSITORY: ${{ github.repository }}
       run: >-
         gh release create
-        '${{ github.ref_name }}'
-        --repo '${{ github.repository }}'
+        '${REF_NAME}'
+        --repo '${REPOSITORY}'
         --generate-notes
     - name: Upload artifact signatures to GitHub Release
       env:
         GITHUB_TOKEN: ${{ github.token }}
+        REF_NAME: ${{ github.ref_name }}
+        REPOSITORY: ${{ github.repository }}
       run: >-
         gh release upload
-        '${{ github.ref_name }}' dist/**
-        --repo '${{ github.repository }}'
+        '${REF_NAME}' dist/**
+        --repo '${REPOSITORY}'
 
   build-for-prefix:
     name: Build prefix package
@@ -104,13 +110,17 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Download the built dist
         uses: actions/download-artifact@v4
         with:
           name: pip-dist
           path: dist/
       - name: Add tag to recipe
-        run: sed -i "s/TAG_VERSION/${{ github.ref_name }}/g" publish/recipes/release/ecoscope.yaml
+        env: 
+          REF_NAME: ${{ github.ref_name }}
+        run: sed -i "s/TAG_VERSION/${REF_NAME}/g" publish/recipes/release/ecoscope.yaml
       - name: Add dist to recipe
         run: sed -i "s/DIST_NAME/$(find ./dist/*.tar.gz  -printf "%f\n")/g" publish/recipes/release/ecoscope.yaml
       - name: Log the generated recipe
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 358dc0af..fc44a81a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -22,6 +22,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+            persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/setup-micromamba@v2.0.2
@@ -40,8 +42,9 @@ jobs:
           ER_PASSWORD: ${{ secrets.ER_PASSWORD }}
           EE_ACCOUNT: ${{ secrets.EE_ACCOUNT }}
           EE_PRIVATE_KEY_DATA: ${{ secrets.EE_PRIVATE_KEY_DATA }}
+          INPUT_IO: ${{inputs.io}}
         run: |
-          pytest -v -r s -m "${{ inputs.io }}" --color=yes --cov=ecoscope --cov-append --cov-report=xml
+          pytest -v -r s -m "${INPUT_IO}" --color=yes --cov=ecoscope --cov-append --cov-report=xml
       
       - name: Codecov
         uses: codecov/codecov-action@v5
\ No newline at end of file