diff --git a/.github/workflows/dispatch-ci.yml b/.github/workflows/dispatch-ci.yml
index cfd92a90..d416d1d9 100644
--- a/.github/workflows/dispatch-ci.yml
+++ b/.github/workflows/dispatch-ci.yml
@@ -1,9 +1,11 @@
 name: Dispatch CI
 
 on:
-  # At 1:10 PM UTC, only on Saturday and Sunday
+  # At 2:10 PM UTC, only on Tuesday and Wednesday
   schedule:
-    - cron: '10 13 * * 6,0'
+    - cron: '10 14 * * 2,3'
+
+permissions: {}
 
 jobs:
   dispatch-ci:
@@ -11,6 +13,9 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Dispatch CI
         uses: silverstripe/gha-dispatch-ci@v1
diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index 715da5ed..fe2ecc5d 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -1,17 +1,21 @@
 name: Keepalive
 
 on:
-  # At 4:20 PM UTC, on day 21 of the month
+  # At 11:55 AM UTC, on day 24 of the month
   schedule:
-    - cron: '20 16 21 * *'
+    - cron: '55 11 24 * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   keepalive:
     name: Keepalive
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Keepalive
         uses: silverstripe/gha-keepalive@v1
diff --git a/.github/workflows/merge-up.yml b/.github/workflows/merge-up.yml
index b741a814..53f21d65 100644
--- a/.github/workflows/merge-up.yml
+++ b/.github/workflows/merge-up.yml
@@ -1,17 +1,22 @@
 name: Merge-up
 
 on:
-  # At 1:10 PM UTC, only on Wednesday
+  # At 2:10 PM UTC, only on Saturday
   schedule:
-    - cron: '10 13 * * 3'
+    - cron: '10 14 * * 6'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   merge-up:
     name: Merge-up
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
     steps:
       - name: Merge-up
         uses: silverstripe/gha-merge-up@v1
diff --git a/.github/workflows/tag-patch-release.yml b/.github/workflows/tag-patch-release.yml
new file mode 100644
index 00000000..dc2db2ba
--- /dev/null
+++ b/.github/workflows/tag-patch-release.yml
@@ -0,0 +1,26 @@
+name: Tag patch release
+
+on:
+  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      latest_local_sha:
+        description: The latest local sha
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  tagpatchrelease:
+    name: Tag patch release
+    # Only run cron on the silverstripe account
+    if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Tag release
+        uses: silverstripe/gha-tag-release@v2
+        with:
+          latest_local_sha: ${{ inputs.latest_local_sha }}
diff --git a/.github/workflows/update-js.yml b/.github/workflows/update-js.yml
index b8ae4a98..9e9f991e 100644
--- a/.github/workflows/update-js.yml
+++ b/.github/workflows/update-js.yml
@@ -2,9 +2,11 @@ name: Update JS
 
 on:
   workflow_dispatch:
-  # Run on a schedule of once per quarter
+  # At 6:30 PM UTC, on day 1 of the month, only in March and September
   schedule:
-    - cron: '20 16 1 */3 *'
+    - cron: '30 18 1 3,9 *'
+
+permissions: {}
 
 jobs:
   update-js:
@@ -12,6 +14,10 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     steps:
       - name: Update JS
         uses: silverstripe/gha-update-js@v1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
deleted file mode 100644
index 7b05bf74..00000000
--- a/CONTRIBUTING.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Contributing
-
-Any open source product is only as good as the community behind it. You can participate by sharing code, ideas, or simply helping others. No matter what your skill level is, every contribution counts.
-
-See our [high level overview](http://silverstripe.org/contributing-to-silverstripe) on silverstripe.org on how you can help out.
-
-Or, for more detailed guidance, read one of the following pages:
-
- * [Sharing your opinion and raising issues](http://docs.silverstripe.org/en//contributing/issues_and_bugs/)
- * [Providing code, whether it's creating a feature or fixing a bug](http://docs.silverstripe.org/en/contributing/code/)
- * [Writing and translating documentation](http://docs.silverstripe.org/en/contributing/translations/)
- * [Translating user-interface elements](http://docs.silverstripe.org/en/contributing/translation_process/)