diff --git a/.ci/docker-ci/arch/Dockerfile b/.ci/docker-ci/arch/Dockerfile
index e14e7b318..5b7bb35b0 100644
--- a/.ci/docker-ci/arch/Dockerfile
+++ b/.ci/docker-ci/arch/Dockerfile
@@ -1,4 +1,4 @@
-FROM archlinux:base-20220529.0.58327
+FROM archlinux/archlinux:base-20221113.0.102202
 
 LABEL maintainer="mail@sobolevn.me"
 LABEL vendor="git-secret team"
diff --git a/.github/workflows/build-man.yml b/.github/workflows/build-man.yml
index f2528e32a..8ae2db5c2 100644
--- a/.github/workflows/build-man.yml
+++ b/.github/workflows/build-man.yml
@@ -14,8 +14,11 @@ on:
       - '.github/workflows/build-man.yml'
   workflow_dispatch:
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}-build-man
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
index 3c2d70ab0..59110833d 100644
--- a/.github/workflows/github-pages.yml
+++ b/.github/workflows/github-pages.yml
@@ -9,13 +9,18 @@ on:
       - 'docs/**/*'
       - 'utils/*/install.sh'
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
     - uses: actions/checkout@v6
diff --git a/.github/workflows/release-ci.yml b/.github/workflows/release-ci.yml
index 7ae6679ba..2f569ead1 100644
--- a/.github/workflows/release-ci.yml
+++ b/.github/workflows/release-ci.yml
@@ -21,8 +21,11 @@ on:
       - 'Makefile'
       - '.github/workflows/release-ci.yml'
 
+permissions:
+  contents: read
+
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d2365e3d0..51915ee65 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
 
 jobs:
   release-packages:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3ffc289e4..5891f5dc9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,8 +11,11 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}-test
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 permissions:
@@ -34,7 +37,7 @@ jobs:
         docker-env:
           - alma
           - alpine
-          #- arch           # disable arch testing for now, see #916
+          - arch
           - debian-gnupg1  # We need to test legacy version of gnupg
           - debian-gnupg2
           - fedora