diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
index f6aacc723..c54fc4d14 100644
--- a/.github/release-drafter.yml
+++ b/.github/release-drafter.yml
@@ -1,3 +1,6 @@
+name-template: 'Draft: v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+change-template: '- $TITLE (#$NUMBER) @$AUTHOR'
 categories:
   - title: 'Breaking Changes'
     labels:
@@ -21,6 +24,26 @@ categories:
       - 'dependencies'
       - 'chore'
       - 'github_actions'
+version-resolver:
+  major:
+    labels:
+      - 'breaking'
+  minor:
+    labels:
+      - 'feature'
+      - 'enhancement'
+      - 'new computation'
+  patch:
+    labels:
+      - 'fix'
+      - 'bug'
+      - 'bugfix'
+      - 'refactor'
+      - 'documentation'
+      - 'dependencies'
+      - 'chore'
+      - 'github_actions'
+  default: patch
 template: |
   # What's Changed
 
diff --git a/.github/workflows/ci-python.yml b/.github/workflows/ci-python.yml
index 3b3af0c0d..56c9e9967 100644
--- a/.github/workflows/ci-python.yml
+++ b/.github/workflows/ci-python.yml
@@ -1,4 +1,6 @@
 name: Python checks
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 938bb72d6..2e70adcba 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -22,6 +22,8 @@ jobs:
   run:
     name: Codecov
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v5
       with:
diff --git a/.github/workflows/publish_to_pypi.yml b/.github/workflows/publish_to_pypi.yml
index 4f23e6c4d..419d12646 100644
--- a/.github/workflows/publish_to_pypi.yml
+++ b/.github/workflows/publish_to_pypi.yml
@@ -8,6 +8,8 @@ on:
 jobs:
   deploy:
     name: Build and upload wheels
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
 
diff --git a/.github/workflows/release_drafter.yml b/.github/workflows/release_drafter.yml
index cf1c4f7f2..c31811563 100644
--- a/.github/workflows/release_drafter.yml
+++ b/.github/workflows/release_drafter.yml
@@ -6,6 +6,8 @@ on:
 
 jobs:
   update_release_draft:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Release Drafter