diff --git a/.github/workflows/dispatch-ci.yml b/.github/workflows/dispatch-ci.yml
index 18bdf9a8b..45d3270c0 100644
--- a/.github/workflows/dispatch-ci.yml
+++ b/.github/workflows/dispatch-ci.yml
@@ -1,9 +1,11 @@
 name: Dispatch CI
 
 on:
-  # At 12:00 PM UTC, only on Tuesday and Wednesday
+  # At 12:00 AM UTC, only on Saturday and Sunday
   schedule:
-    - cron: '0 12 * * 2,3'
+    - cron: '0 0 * * 6,0'
+
+permissions: {}
 
 jobs:
   dispatch-ci:
@@ -11,6 +13,9 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
     steps:
       - name: Dispatch CI
         uses: silverstripe/gha-dispatch-ci@v1
diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index 5c205f5ab..69d507746 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -1,17 +1,21 @@
 name: Keepalive
 
 on:
-  # At 9:45 AM UTC, on day 14 of the month
+  # At 9:45 PM UTC, on day 14 of the month
   schedule:
-    - cron: '45 9 14 * *'
+    - cron: '45 21 14 * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   keepalive:
     name: Keepalive
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Keepalive
         uses: silverstripe/gha-keepalive@v1
diff --git a/.github/workflows/merge-up.yml b/.github/workflows/merge-up.yml
index a98d98390..c37c2f49a 100644
--- a/.github/workflows/merge-up.yml
+++ b/.github/workflows/merge-up.yml
@@ -1,17 +1,22 @@
 name: Merge-up
 
 on:
-  # At 12:00 PM UTC, only on Saturday
+  # At 12:00 AM UTC, only on Wednesday
   schedule:
-    - cron: '0 12 * * 6'
+    - cron: '0 0 * * 3'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   merge-up:
     name: Merge-up
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
     steps:
       - name: Merge-up
         uses: silverstripe/gha-merge-up@v1
diff --git a/.github/workflows/tag-patch-release.yml b/.github/workflows/tag-patch-release.yml
new file mode 100644
index 000000000..dc2db2bad
--- /dev/null
+++ b/.github/workflows/tag-patch-release.yml
@@ -0,0 +1,26 @@
+name: Tag patch release
+
+on:
+  # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
+  workflow_dispatch:
+    inputs:
+      latest_local_sha:
+        description: The latest local sha
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  tagpatchrelease:
+    name: Tag patch release
+    # Only run cron on the silverstripe account
+    if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Tag release
+        uses: silverstripe/gha-tag-release@v2
+        with:
+          latest_local_sha: ${{ inputs.latest_local_sha }}
diff --git a/.github/workflows/update-js.yml b/.github/workflows/update-js.yml
index 9c64778e5..afff16f13 100644
--- a/.github/workflows/update-js.yml
+++ b/.github/workflows/update-js.yml
@@ -2,9 +2,11 @@ name: Update JS
 
 on:
   workflow_dispatch:
-  # Run on a schedule of once per quarter
+  # At 4:20 AM UTC, on day 1 of the month, only in March and September
   schedule:
-    - cron: '45 9 1 */3 *'
+    - cron: '20 4 1 3,9 *'
+
+permissions: {}
 
 jobs:
   update-js:
@@ -12,6 +14,10 @@ jobs:
     # Only run cron on the silverstripe account
     if: (github.event_name == 'schedule' && github.repository_owner == 'silverstripe') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
     steps:
       - name: Update JS
         uses: silverstripe/gha-update-js@v1
diff --git a/contributing.md b/contributing.md
deleted file mode 100644
index fa6fa4dad..000000000
--- a/contributing.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Contributing
-
-Any open source product is only as good as the community behind it. You can participate by sharing code, ideas, or simply helping others. No matter what your skill level is, every contribution counts.
-
-See our [high level overview](http://silverstripe.org/contributing-to-silverstripe) on silverstripe.org on how you can help out.
-
-Or, for more detailed guidance, read one of the following pages:
-
- * [Sharing your opinion and raising issues](http://docs.silverstripe.org/en/3.2/contributing/issues_and_bugs/)
- * [Providing code, whether it's creating a feature or fixing a bug](http://docs.silverstripe.org/en/3.2/contributing/code/)
- * [Writing and translating documentation](http://docs.silverstripe.org/en/3.2/contributing/translations/)
- * [Translating user-interface elements](http://docs.silverstripe.org/en/3.2/contributing/translation_process/)