diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml
index 3f7ec38..521ab13 100644
--- a/.github/actions/setup-go/action.yml
+++ b/.github/actions/setup-go/action.yml
@@ -17,7 +17,19 @@ runs:
     - name: Configure Git for access to the Go SDK's staging repo
       if: github.repository == 'stainless-sdks/openai-cli'
       shell: bash
-      run: git config --global url."https://x-access-token:${{ steps.get_token.outputs.github_access_token }}@github.com/stainless-sdks/openai-go".insteadOf "https://github.com/stainless-sdks/openai-go"
+      env:
+        GITHUB_ACCESS_TOKEN: ${{ steps.get_token.outputs.github_access_token }}
+      run: |
+        git_config_global="${RUNNER_TEMP}/stainless-gitconfig"
+        if [[ -f "${HOME}/.gitconfig" ]]; then
+          cp "${HOME}/.gitconfig" "$git_config_global"
+        else
+          touch "$git_config_global"
+        fi
+        chmod 600 "$git_config_global"
+        token_username="x-access-token"
+        git config --file "$git_config_global" url."https://${token_username}:${GITHUB_ACCESS_TOKEN}@github.com/stainless-sdks/openai-go".insteadOf "https://github.com/stainless-sdks/openai-go"
+        echo "GIT_CONFIG_GLOBAL=$git_config_global" >> "$GITHUB_ENV"
 
     - name: Setup go
       uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97738aa..36d2860 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,6 @@
 name: CI
+permissions:
+  contents: read
 on:
   push:
     branches:
@@ -35,8 +37,10 @@ jobs:
 
       - name: Link staging branch
         if: github.repository == 'stainless-sdks/openai-cli'
+        env:
+          GO_SDK_REPLACEMENT: github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}
         run: |
-          ./scripts/link 'github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}' || true
+          ./scripts/link "$GO_SDK_REPLACEMENT" || true
 
       - name: Bootstrap
         run: ./scripts/bootstrap
@@ -63,8 +67,10 @@ jobs:
 
       - name: Link staging branch
         if: github.repository == 'stainless-sdks/openai-cli'
+        env:
+          GO_SDK_REPLACEMENT: github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}
         run: |
-          ./scripts/link 'github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}' || true
+          ./scripts/link "$GO_SDK_REPLACEMENT" || true
 
       - name: Bootstrap
         run: ./scripts/bootstrap
@@ -116,8 +122,10 @@ jobs:
 
       - name: Link staging branch
         if: github.repository == 'stainless-sdks/openai-cli'
+        env:
+          GO_SDK_REPLACEMENT: github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}
         run: |
-          ./scripts/link 'github.com/stainless-sdks/openai-go/v3@${{ github.ref_name }}' || true
+          ./scripts/link "$GO_SDK_REPLACEMENT" || true
 
       - name: Bootstrap
         run: ./scripts/bootstrap
diff --git a/.github/workflows/create-releases.yml b/.github/workflows/create-releases.yml
index edc88e5..d232570 100644
--- a/.github/workflows/create-releases.yml
+++ b/.github/workflows/create-releases.yml
@@ -12,14 +12,9 @@ jobs:
     if: github.ref == 'refs/heads/main' && github.repository == 'openai/openai-cli'
     runs-on: ubuntu-latest
     environment: publish
-    permissions:
-      contents: write
+    permissions: {}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          persist-credentials: false
-
       - uses: stainless-api/trigger-release-please@bb6677c5a04578eec1ccfd9e1913b5b78ed64c61 # v1.4.0
         id: release
         with:
diff --git a/scripts/utils/upload-artifact.sh b/scripts/utils/upload-artifact.sh
index 996781d..0d564c6 100755
--- a/scripts/utils/upload-artifact.sh
+++ b/scripts/utils/upload-artifact.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -exuo pipefail
+set -euo pipefail
 
 BINARY_NAME="openai"
 DIST_DIR="dist"
@@ -35,7 +35,7 @@ done
 
 (cd "$DIST_DIR" && zip -r "$FILENAME" "${relative_files[@]}")
 
-RESPONSE=$(curl -X POST "$URL?filename=$FILENAME" \
+RESPONSE=$(curl --fail-with-body -sS -X POST "$URL?filename=$FILENAME" \
   -H "Authorization: Bearer $AUTH" \
   -H "Content-Type: application/json")
 
@@ -46,11 +46,11 @@ if [[ "$SIGNED_URL" == "null" ]]; then
   exit 1
 fi
 
-UPLOAD_RESPONSE=$(curl -v -X PUT \
+if curl --fail-with-body -sS -X PUT \
   -H "Content-Type: application/zip" \
-  --data-binary "@${DIST_DIR}/${FILENAME}" "$SIGNED_URL" 2>&1)
-
-if echo "$UPLOAD_RESPONSE" | grep -q "HTTP/[0-9.]* 200"; then
+  --data-binary "@${DIST_DIR}/${FILENAME}" \
+  --output /dev/null \
+  "$SIGNED_URL"; then
   echo -e "\033[32mUploaded build to Stainless storage.\033[0m"
   echo -e "\033[32mInstallation: Download and unzip: 'https://pkg.stainless.com/s/openai-cli/$SHA'. On macOS, run 'xattr -d com.apple.quarantine {executable name}'.\033[0m"
 else