diff --git a/.github/workflows/build_and_push_image.yml b/.github/workflows/build_and_push_image.yml
index 9deae61428..3a7f9aaa63 100644
--- a/.github/workflows/build_and_push_image.yml
+++ b/.github/workflows/build_and_push_image.yml
@@ -3,16 +3,14 @@ name: Build and push narrative images
 
 on:
   workflow_call:
-    secrets:
-      GHCR_USERNAME:
-        required: true
-      GHCR_TOKEN:
-        required: true
 
 jobs:
   docker_build_image:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
     -
       name: Check out GitHub Repo
@@ -42,17 +40,17 @@ jobs:
       run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
     -
       name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@master
+      uses: docker/setup-buildx-action@v4
     -
       name: Log in to the Container registry
-      uses: docker/login-action@master
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
-        username: ${{ secrets.GHCR_USERNAME }}
-        password: ${{ secrets.GHCR_TOKEN }}
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
     -
       name: Build narrative image
-      uses: docker/build-push-action@master
+      uses: docker/build-push-action@v7
       with:
         context: .
         file: ./Dockerfile
@@ -61,14 +59,14 @@ jobs:
         tags: ${{ env.APP_IMAGE_TAG }}
         build-args: |
           BRANCH=${{ github.head_ref }}
-          BUILD_DATE=${{ steps.date.output.date }}
+          BUILD_DATE=${{ steps.date.outputs.date }}
           NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }}
           VCS_REF=${{ github.sha }}
           TAG='${{ github.ref }}'
     -
       name: Build version image
-      uses: docker/build-push-action@master
-      if: ${{ github.base_ref }} == 'main' || ${{ github.base_ref }} == 'develop'
+      uses: docker/build-push-action@v7
+      if: ${{ github.base_ref == 'main' || github.base_ref == 'develop' }}
       with:
         context: .
         push: true
@@ -76,7 +74,7 @@ jobs:
         tags: ${{ env.APP_VERSION_IMAGE_TAG }}
         build-args: |
           BRANCH=${{ github.head_ref }}
-          BUILD_DATE=${{ steps.date.output.date }}
+          BUILD_DATE=${{ steps.date.outputs.date }}
           NARRATIVE_VERSION=${{ env.NARRATIVE_VERSION }}
           NARRATIVE_GIT_HASH=${{ env.NARRATIVE_GIT_HASH }}
           VCS_REF=${{ github.sha }}
diff --git a/.github/workflows/build_prodrc_pr.yaml b/.github/workflows/build_prodrc_pr.yaml
index 2d0fd53416..33c55a808b 100644
--- a/.github/workflows/build_prodrc_pr.yaml
+++ b/.github/workflows/build_prodrc_pr.yaml
@@ -12,22 +12,15 @@ on:
 jobs:
   run_build_and_push:
     uses: ./.github/workflows/build_and_push_image.yml
-    secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
 
   run_unit_tests:
     uses: ./.github/workflows/unit_test.yml
     needs: run_build_and_push
     secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   run_integration_tests:
     uses: ./.github/workflows/integration_test.yml
     needs: run_build_and_push
     secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
       NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }}
diff --git a/.github/workflows/build_test_pr.yaml b/.github/workflows/build_test_pr.yaml
index e4c10a5a21..683eab3d0e 100644
--- a/.github/workflows/build_test_pr.yaml
+++ b/.github/workflows/build_test_pr.yaml
@@ -12,9 +12,6 @@ on:
 jobs:
   run_build_and_push:
     uses: ./.github/workflows/build_and_push_image.yml
-    secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
 
   trivy-scans:
     if: (github.base_ref == 'develop' || github.base_ref == 'main' ) && github.event.pull_request.merged == false
@@ -25,14 +22,10 @@ jobs:
     uses: ./.github/workflows/unit_test.yml
     needs: run_build_and_push
     secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   run_integration_tests:
     uses: ./.github/workflows/integration_test.yml
     needs: run_build_and_push
     secrets:
-      GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
-      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
       NARRATIVE_TEST_TOKEN: ${{ secrets.NARRATIVE_TEST_TOKEN }}
diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
index c63e97545a..06364ff3fc 100644
--- a/.github/workflows/integration_test.yml
+++ b/.github/workflows/integration_test.yml
@@ -3,27 +3,25 @@ name: CI integration testing
 on:
   workflow_call:
     secrets:
-      GHCR_USERNAME:
-        required: true
-      GHCR_TOKEN:
-        required: true
       NARRATIVE_TEST_TOKEN:
         required: true
 
 jobs:
   run_integration_tests:
     runs-on: ubuntu-latest
+    permissions:
+      packages: read
     steps:
     -
       name: Log in to the Container registry
-      uses: docker/login-action@master
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
-        username: ${{ secrets.GHCR_USERNAME }}
-        password: ${{ secrets.GHCR_TOKEN }}
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
     -
       name: Repo checkout
-      uses: actions/checkout@master
+      uses: actions/checkout@main
     -
       name: Set up environment
       run: |
diff --git a/.github/workflows/tag_latest_image.yaml b/.github/workflows/tag_latest_image.yaml
index bf3350bca2..efce3de741 100644
--- a/.github/workflows/tag_latest_image.yaml
+++ b/.github/workflows/tag_latest_image.yaml
@@ -12,6 +12,8 @@ jobs:
   docker_tag:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
     steps:
     - name: Check out GitHub Repo
       with:
@@ -19,11 +21,11 @@ jobs:
       uses: actions/checkout@master
     -
       name: Log in to the Container registry
-      uses: docker/login-action@master
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
-        username: ${{ secrets.GHCR_USERNAME }}
-        password: ${{ secrets.GHCR_TOKEN }}
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
     -
       name: Set up environment
       run: |
diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml
index 25d5ae1bb5..17ca68aed9 100644
--- a/.github/workflows/unit_test.yml
+++ b/.github/workflows/unit_test.yml
@@ -3,24 +3,22 @@ name: CI unit testing
 on:
   workflow_call:
     secrets:
-      GHCR_USERNAME:
-        required: true
-      GHCR_TOKEN:
-        required: true
       CODECOV_TOKEN:
         required: true
 
 jobs:
   run_unit_tests:
     runs-on: ubuntu-latest
+    permissions:
+      packages: read
     steps:
     -
       name: Log in to the Container registry
-      uses: docker/login-action@master
+      uses: docker/login-action@v4
       with:
         registry: ghcr.io
-        username: ${{ secrets.GHCR_USERNAME }}
-        password: ${{ secrets.GHCR_TOKEN }}
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
     -
       name: Repo checkout
       uses: actions/checkout@master
@@ -76,7 +74,7 @@ jobs:
     -
       name: Send to Codecov
       id: send_to_codecov
-      uses: codecov/codecov-action@main
+      uses: codecov/codecov-action@v7
       continue-on-error: true
       with:
         token: ${{ secrets.CODECOV_TOKEN }}