diff --git a/.github/workflows/milestone-merged-prs.yaml b/.github/workflows/milestone-merged-prs.yaml
index f455839..2828edd 100644
--- a/.github/workflows/milestone-merged-prs.yaml
+++ b/.github/workflows/milestone-merged-prs.yaml
@@ -1,18 +1,23 @@
 name: Milestone
 
 on:
-  pull_request_target:
-    types:
-      - closed
+  push:
     branches:
       - "main"
 
+permissions: {}
+
 jobs:
   milestone_pr:
-    name: attach to PR
+    if: github.repository == 'scientific-python/spin'
     runs-on: ubuntu-latest
+
+    permissions:
+      issues: write
+      pull-requests: write
+
     steps:
-      - uses: scientific-python/attach-next-milestone-action@c9cfab10ad0c67fed91b01103db26b7f16634639
+      - uses: scientific-python/attach-next-milestone-action@796cfa44ba1e1a9a4bce7896241d4612a3f06327
         with:
-          token: ${{ secrets.MILESTONE_LABELER_TOKEN }}
+          token: ${{ github.token }}
           force: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 73564b6..d78c1e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,11 +14,11 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         name: Install Python
         with:
           python-version: "3.11"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 323bfc6..7c97cce 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,8 +24,8 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         id: setup-python
         with:
           python-version: ${{ matrix.python_version }}