diff --git a/.github/workflows/bot_pr_approval.yaml b/.github/workflows/bot_pr_approval.yaml
index f284fd7..638e931 100644
--- a/.github/workflows/bot_pr_approval.yaml
+++ b/.github/workflows/bot_pr_approval.yaml
@@ -6,5 +6,7 @@ on:
 jobs:
   bot_pr_approval:
     uses: canonical/operator-workflows/.github/workflows/bot_pr_approval.yaml@main
+    permissions:
+      pull-requests: write
     secrets: inherit
 
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index a9c0d62..806508a 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -40,10 +40,10 @@ jobs:
       id: snapcraft-build
       uses: snapcore/action-build@v1
 
-    - uses: actions/upload-artifact@v5
-      with:
-        name: charmed-http-proxy-policy-snap
-        path: "*.snap"
+      - uses: actions/upload-artifact@v6
+        with:
+          name: charmed-http-proxy-policy-snap
+          path: "*.snap"
 
     - name: Publish Snap
       env:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6e760a6..071596e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -15,6 +15,9 @@ jobs:
       matrix:
         charm: [squid-forward-proxy, http-proxy-policy, http-proxy-configurator]
     uses: canonical/operator-workflows/.github/workflows/test.yaml@main
+    permissions:
+      contents: read
+      pull-requests: write
     secrets: inherit
     with:
       self-hosted-runner: false
@@ -30,6 +33,10 @@ jobs:
         charm: [squid-forward-proxy, http-proxy-policy, http-proxy-configurator]
     uses: 
       canonical/operator-workflows/.github/workflows/integration_test.yaml@main
+    permissions:
+      contents: read
+      packages: write
+      pull-requests: write
     secrets: inherit
     with:
       juju-channel: '3/stable'
@@ -42,13 +49,15 @@ jobs:
       contents: write
     needs:
     - integration-tests
+    permissions:
+      contents: write
     uses: canonical/operator-workflows/.github/workflows/allure_report.yaml@main
 
   http-proxy-policy:
     name: HTTP Proxy Policy Tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.1
+    - uses: actions/checkout@v6.0.2
     - uses: actions/setup-python@v6
       with:
         python-version: '3.x'
@@ -75,7 +84,7 @@ jobs:
       id: snapcraft-build
       uses: snapcore/action-build@v1
 
-    - uses: actions/upload-artifact@v5
+    - uses: actions/upload-artifact@v6
       with:
         name: charmed-http-proxy-policy-snap
         path: "*.snap"
diff --git a/http-proxy-configurator-operator/requirements.txt b/http-proxy-configurator-operator/requirements.txt
index f157cae..4bcb95f 100644
--- a/http-proxy-configurator-operator/requirements.txt
+++ b/http-proxy-configurator-operator/requirements.txt
@@ -1,2 +1,2 @@
-ops==3.4.0
+ops==3.5.1
 pydantic==2.12.5
diff --git a/http-proxy-policy-operator/requirements.txt b/http-proxy-policy-operator/requirements.txt
index 6a9d2c1..b222c13 100644
--- a/http-proxy-policy-operator/requirements.txt
+++ b/http-proxy-policy-operator/requirements.txt
@@ -1,3 +1,3 @@
-ops==3.4.0
+ops==3.5.1
 pydantic==2.12.5
 requests==2.32.5
diff --git a/squid-forward-proxy-operator/requirements.txt b/squid-forward-proxy-operator/requirements.txt
index f157cae..4bcb95f 100644
--- a/squid-forward-proxy-operator/requirements.txt
+++ b/squid-forward-proxy-operator/requirements.txt
@@ -1,2 +1,2 @@
-ops==3.4.0
+ops==3.5.1
 pydantic==2.12.5