diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9bf0709..d65b8b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,9 @@ jobs:
 
       - name: Flake check
         run: nix flake check
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''
 
   deploy:
     runs-on: ubuntu-latest
@@ -52,3 +55,6 @@ jobs:
 
       - name: Deploy
         run: nix develop --command deploy
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 5404aa9..2704236 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -23,6 +23,9 @@ jobs:
             access-tokens = github.com=${{ secrets.AUTOUPDATE_TOKEN }}
       - name: Update flake.lock
         uses: DeterminateSystems/update-flake-lock@v20
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''
         with:
           pr-title: "update flake inputs"
           pr-labels: |