diff --git a/.github/workflows/auto-deploy-cloud.yml b/.github/workflows/auto-deploy-cloud.yml
index e19825364e..b263788002 100644
--- a/.github/workflows/auto-deploy-cloud.yml
+++ b/.github/workflows/auto-deploy-cloud.yml
@@ -36,6 +36,14 @@ jobs:
     steps:
       - name: Checkout OSS repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing in this job pushes from the OSS working copy -- every git
+          # command below runs after `cd clawmetry-cloud`, against the second
+          # checkout and its CLOUD_REPO_PAT. So this credential has no consumer
+          # and only stands in .git/config for the rest of the job. Do NOT copy
+          # this to the checkout below: that one's credential is the one the
+          # force-push uses.
+          persist-credentials: false
 
       - name: Get OSS version
         id: oss_version
diff --git a/.github/workflows/desktop-artifacts.yml b/.github/workflows/desktop-artifacts.yml
index 805c3a232d..c74f23fbb5 100644
--- a/.github/workflows/desktop-artifacts.yml
+++ b/.github/workflows/desktop-artifacts.yml
@@ -41,6 +41,8 @@ jobs:
       HAS_SIGN: ${{ secrets.MACOS_SIGN_IDENTITY != '' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Same rule as the Windows job: signing is optional everywhere except
       # a release tag. An unsigned .dmg is refused by Gatekeeper outright,
@@ -288,6 +290,8 @@ jobs:
       HAS_WIN_CERT: ${{ secrets.WINDOWS_CERT_PFX_BASE64 != '' && !(secrets.AZURE_CLIENT_ID != '' && secrets.AZ_SIGN_PROFILE != '') }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # A tag build that quietly produces an UNSIGNED artifact is worse
       # than a failed build: it reaches users as "unknown publisher", and
       # on Windows an unsigned uninstaller stub is blocked by Smart App
@@ -539,6 +543,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
diff --git a/.github/workflows/moat-keystone-drive-nightly.yml b/.github/workflows/moat-keystone-drive-nightly.yml
index 43a969528d..e299e937e2 100644
--- a/.github/workflows/moat-keystone-drive-nightly.yml
+++ b/.github/workflows/moat-keystone-drive-nightly.yml
@@ -46,6 +46,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3312ba3757..2549eb3317 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,6 +32,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with: