diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e3b07da..987dee35 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
           node-version: 22
 
       - name: Install workspace deps
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Run codegen
         run: ./scripts/codegen.sh
@@ -114,7 +114,7 @@ jobs:
           name: codegen-output
 
       - name: Install
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Build
         run: npm run build --prefix js/packages/truapi
@@ -143,7 +143,9 @@ jobs:
           name: codegen-output
 
       - name: Install workspace deps + build @parity/truapi
-        run: npm ci
+        run: |
+          npm ci --ignore-scripts
+          npm run build --prefix js/packages/truapi
 
       - name: Install playground deps
         working-directory: playground
@@ -186,7 +188,9 @@ jobs:
           name: codegen-output
 
       - name: Install workspace deps + build @parity/truapi
-        run: npm ci
+        run: |
+          npm ci --ignore-scripts
+          npm run build --prefix js/packages/truapi
 
       - name: Install explorer deps
         working-directory: explorer
@@ -229,7 +233,9 @@ jobs:
           name: codegen-output
 
       - name: Build @parity/truapi
-        run: npm ci
+        run: |
+          npm ci --ignore-scripts
+          npm run build --prefix js/packages/truapi
 
       - name: Install dotli deps
         working-directory: hosts/dotli
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 61dab6e7..8b2c541a 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -15,6 +15,10 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/diagnosis-report.yml b/.github/workflows/diagnosis-report.yml
index f6f5d5f6..bde33556 100644
--- a/.github/workflows/diagnosis-report.yml
+++ b/.github/workflows/diagnosis-report.yml
@@ -34,6 +34,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           BODY: ${{ github.event.issue.body }}
           ISSUE: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
 
@@ -64,7 +65,7 @@ jobs:
           fi
           git add "$file"
           git commit -m "diagnosis: update $host report (from #$ISSUE)"
-          git push -f origin "$branch"
+          git push -f "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "$branch"
 
           # One open PR per host branch: reuse it while it is open, open a new
           # one once the previous report has merged (a merged/closed PR for the
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ab648b53..6a0a0914 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,13 +85,11 @@ jobs:
         env:
           STEPS_VERSION_OUTPUTS_TAG: ${{ steps.version.outputs.tag }}
 
-      # --ignore-scripts skips the `prepare` hook so we don't rebuild what
-      # the Build step just produced.
       - name: Pack package
         if: steps.version.outputs.proceed == 'true'
         run: |
           mkdir -p artifacts
-          (cd js/packages/truapi && npm pack --ignore-scripts --pack-destination "$GITHUB_WORKSPACE/artifacts/")
+          (cd js/packages/truapi && npm pack --pack-destination "$GITHUB_WORKSPACE/artifacts/")
 
       - name: Upload package artifacts
         if: steps.version.outputs.proceed == 'true'
diff --git a/js/packages/truapi-host/package.json b/js/packages/truapi-host/package.json
index 37590343..343626e7 100644
--- a/js/packages/truapi-host/package.json
+++ b/js/packages/truapi-host/package.json
@@ -31,7 +31,6 @@
     "ensure-generated": "./scripts/ensure-generated.sh",
     "build": "tsc",
     "prebuild": "npm run ensure-generated",
-    "prepare": "npm run build",
     "codegen": "cargo run -p truapi-codegen -- --input ../../../target/doc/truapi.json --output ../truapi/src/generated --host-output src/generated",
     "typecheck": "npm run build",
     "pretest": "npm run ensure-generated",
diff --git a/js/packages/truapi/package.json b/js/packages/truapi/package.json
index 2a07be2e..46ae9d73 100644
--- a/js/packages/truapi/package.json
+++ b/js/packages/truapi/package.json
@@ -64,7 +64,6 @@
     "ensure-generated": "./scripts/ensure-generated.sh",
     "build": "tsc",
     "prebuild": "npm run ensure-generated",
-    "prepare": "npm run build",
     "codegen": "cargo run -p truapi-codegen -- --input ../../../target/doc/truapi.json --output src/generated --playground-output src/playground --explorer-output src/explorer",
     "typecheck": "npm run build",
     "pretest": "npm run ensure-generated",