diff --git a/.github/workflows/dispatch-ci.yml b/.github/workflows/dispatch-ci.yml
index b942c83..5fe2d50 100644
--- a/.github/workflows/dispatch-ci.yml
+++ b/.github/workflows/dispatch-ci.yml
@@ -1,9 +1,11 @@
 name: Dispatch CI
 
 on:
-  # At 12:30 PM UTC, only on Thursday and Friday
+  # At 12:00 AM UTC, only on Tuesday and Wednesday
   schedule:
-    - cron: '30 12 * * 4,5'
+    - cron: '0 0 * * 2,3'
+
+permissions: {}
 
 jobs:
   dispatch-ci:
@@ -11,6 +13,9 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Dispatch CI
         uses: silverstripe/gha-dispatch-ci@v1
diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index 089e1ee..8caad20 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -1,17 +1,21 @@
 name: Keepalive
 
 on:
-  # At 10:50 PM UTC, on day 27 of the month
+  # At 9:45 PM UTC, on day 10 of the month
   schedule:
-    - cron: '50 22 27 * *'
+    - cron: '45 21 10 * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   keepalive:
     name: Keepalive
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Keepalive
         uses: silverstripe/gha-keepalive@v1
diff --git a/.github/workflows/merge-up.yml b/.github/workflows/merge-up.yml
index eb850c3..5124130 100644
--- a/.github/workflows/merge-up.yml
+++ b/.github/workflows/merge-up.yml
@@ -1,17 +1,22 @@
 name: Merge-up
 
 on:
-  # At 12:30 PM UTC, only on Monday
+  # At 12:00 AM UTC, only on Saturday
   schedule:
-    - cron: '30 12 * * 1'
+    - cron: '0 0 * * 6'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   merge-up:
     name: Merge-up
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
     steps:
       - name: Merge-up
         uses: silverstripe/gha-merge-up@v1
diff --git a/.github/workflows/tag-patch-release.yml b/.github/workflows/tag-patch-release.yml
new file mode 100644
index 0000000..dc2db2b
--- /dev/null
+++ b/.github/workflows/tag-patch-release.yml
@@ -0,0 +1,26 @@
+name: Tag patch release
+
+on:
+  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      latest_local_sha:
+        description: The latest local sha
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  tagpatchrelease:
+    name: Tag patch release
+    # Only run cron on the silverstripe account
+    if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Tag release
+        uses: silverstripe/gha-tag-release@v2
+        with:
+          latest_local_sha: ${{ inputs.latest_local_sha }}
diff --git a/.github/workflows/update-js.yml b/.github/workflows/update-js.yml
index 907a74e..afff16f 100644
--- a/.github/workflows/update-js.yml
+++ b/.github/workflows/update-js.yml
@@ -2,9 +2,11 @@ name: Update JS
 
 on:
   workflow_dispatch:
-  # Run on a schedule of once per quarter
+  # At 4:20 AM UTC, on day 1 of the month, only in March and September
   schedule:
-    - cron: '50 22 1 */3 *'
+    - cron: '20 4 1 3,9 *'
+
+permissions: {}
 
 jobs:
   update-js:
@@ -12,6 +14,10 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     steps:
       - name: Update JS
         uses: silverstripe/gha-update-js@v1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
deleted file mode 100644
index 0b52a3e..0000000
--- a/CONTRIBUTING.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Contributing
-
-Any open source module is only as good as the community behind it. You can participate by sharing code, ideas, or simply helping others. No matter what your skill level is, every contribution counts.
-
-For information about sharing code for this module, [please read the sharing code SilverStripe guide](https://docs.silverstripe.org/en/3.1/contributing/code/)
-
-Or, for more detailed guidance, read one of the following pages:
-
- * [Sharing your opinion and raising issues](https://gitlab.cwp.govt.nz/silverstripe/realme/issues)
- * [Providing code, whether it's creating a feature or fixing a bug by sending a merge request](https://gitlab.cwp.govt.nz/silverstripe/realme/merge_requests)
- * [Writing and translating documentation](http://docs.silverstripe.org/en/3.1/contributing/translations/)
- * [Translating user-interface elements](http://docs.silverstripe.org/en/3.1/contributing/translation_process/)
\ No newline at end of file