diff --git a/.github/workflows/create-stable-release.yml b/.github/workflows/create-stable-release.yml
new file mode 100644
index 0000000..8a1a544
--- /dev/null
+++ b/.github/workflows/create-stable-release.yml
@@ -0,0 +1,13 @@
+name: Create stable release
+
+on:
+  schedule:
+    - cron: "0 3 * * 0" # At 03:00 on Sunday
+  workflow_dispatch:
+
+jobs:
+  create-release:
+    permissions:
+      contents: write
+      id-token: write
+    uses: workleap/wl-reusable-workflows/.github/workflows/create-stable-release.yml@main
diff --git a/.github/workflows/jira.yml b/.github/workflows/jira.yml
index a85971b..c226737 100644
--- a/.github/workflows/jira.yml
+++ b/.github/workflows/jira.yml
@@ -10,4 +10,6 @@ jobs:
     uses: workleap/wl-reusable-workflows/.github/workflows/reusable-jira-workflow.yml@main
     with:
       branch_name: ${{ github.head_ref }}
-    secrets: inherit
+    permissions:
+      contents: read
+      id-token: write
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 77b0d05..c5d5567 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -40,8 +40,8 @@ jobs:
 
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: "8.0.x"      
-      
+          dotnet-version: "8.0.x"
+
       - run: ./Build.ps1
         shell: pwsh
         env:
@@ -53,4 +53,6 @@ jobs:
     uses: workleap/wl-reusable-workflows/.github/workflows/linearb-deployment.yml@main
     with:
       environment: 'release'
-    secrets: inherit
+    permissions:
+      id-token: write
+      contents: read