diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8d21338..a591ee9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,8 @@ on:
     # release on tag push
     tags:
       - '*'
+permissions:
+  contents: write
 
 jobs:
   wheels:
@@ -18,8 +20,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04, ubuntu-22.04]
-        python-version: [3.8, '3.10', '3.12']
+        os: [ubuntu-22.04]
+        python-version: [3.9, '3.10', '3.12']
 
     steps:
     - name: Set git crlf/eol
@@ -56,7 +58,7 @@ jobs:
         tox -e build
 
     - name: Upload artifacts
-      if: matrix.python-version == 3.8 && runner.os == 'Linux'
+      if: matrix.python-version == 3.9 && runner.os == 'Linux'
       uses: actions/upload-artifact@v4
       with:
         name: packages
@@ -65,7 +67,7 @@ jobs:
   create_release:
     name: Create Release
     needs: [wheels]
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     steps:
       - name: Get version
@@ -140,4 +142,6 @@ jobs:
       if: ${{ github.event_name == 'push' }}
       uses: JamesIves/github-pages-deploy-action@v4
       with:
+        branch: gh-pages
         folder: docs/_build/html/
+        single-commit: true
diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
index d66ab30..b64897a 100644
--- a/.github/workflows/sphinx.yml
+++ b/.github/workflows/sphinx.yml
@@ -5,6 +5,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: write
 
 jobs:
   build:
@@ -51,7 +53,6 @@ jobs:
       if: ${{ github.event_name == 'push' }}
       uses: JamesIves/github-pages-deploy-action@v4
       with:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        BRANCH: gh-pages
-        FOLDER: docs/_build/html/
-        SINGLE_COMMIT: true
+        branch: gh-pages
+        folder: docs/_build/html/
+        single-commit: true