diff --git a/.ci/scripts/release.sh b/.ci/scripts/release.sh
index a9c3644a9..41d26774f 100755
--- a/.ci/scripts/release.sh
+++ b/.ci/scripts/release.sh
@@ -23,4 +23,4 @@ towncrier build --yes --version "${NEW_VERSION}"
 bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty
 bump-my-version bump patch --commit
 
-git push origin "${BRANCH}" "${NEW_VERSION}"
+git push --atomic origin "${BRANCH}" "${NEW_VERSION}"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d7c6a4ba7..0bc4872ba 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,12 +4,18 @@ name: "Build"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   build:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:
@@ -22,14 +28,14 @@ jobs:
       - name: "Build wheels"
         run: |
           make build
-          touch .root
+          touch ../.root
       - name: "Upload wheels"
         uses: "actions/upload-artifact@v6"
         with:
           name: "pulp_cli_packages"
           path: |
             .root
-            dist/
+            pulp-cli/dist/
           if-no-files-found: "error"
           retention-days: 5
 ...
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index facb1a8ff..129485d1e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,11 +2,12 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches:
-      - "main"
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   analyze:
     name: "Analyze"
@@ -19,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli"
       - name: "Initialize CodeQL"
         uses: "github/codeql-action/init@v4"
         with:
diff --git a/.github/workflows/collect_changes.yml b/.github/workflows/collect_changes.yml
index 5e08242e6..7f8571ce9 100644
--- a/.github/workflows/collect_changes.yml
+++ b/.github/workflows/collect_changes.yml
@@ -4,13 +4,21 @@ on:
   workflow_call:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   collect-changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -32,16 +40,16 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Update Changelog"
           body: ""
           branch: "update_changes"
           delete-branch: true
+          path: "pulp-cli"
       - name: "Mark PR automerge"
         run: |
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
 ...
diff --git a/.github/workflows/cookiecutter.yml b/.github/workflows/cookiecutter.yml
index 64dd8e1df..42cd33d54 100644
--- a/.github/workflows/cookiecutter.yml
+++ b/.github/workflows/cookiecutter.yml
@@ -11,16 +11,21 @@ defaults:
 
 jobs:
   update-ci:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
         with:
           repository: "pulp/pulp-cli"
-          path: "pulp-cli"
-      - uses: "actions/checkout@v6"
+          ref: "main"
+          path: "pulp-cli_cc"
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           path: "pulp-cli"
+          token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:
@@ -36,7 +41,7 @@ jobs:
           git config user.email pulp-infra@redhat.com
       - name: "Apply cookiecutter templates"
         run: |
-          uv run ../pulp-cli/cookiecutter/apply_templates.py
+          uv run ../pulp-cli_cc/cookiecutter/apply_templates.py
           if [ "$(git status --porcelain)" ]
           then
             git add .
@@ -46,17 +51,17 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Update cookiecutter"
           body: ""
           branch: "update_cookiecutter"
           delete-branch: true
           path: "pulp-cli"
+          token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Mark PR automerge"
         run: |
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
 ...
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fee95cdb1..e21a5df2d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,10 @@ name: "Lint"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   lint:
     runs-on: "ubuntu-latest"
@@ -16,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index cf39225a1..8ec5b2609 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,5 +1,5 @@
 ---
-name: "pulp-cli Nightly"
+name: "Nightly"
 
 on:
   schedule:
@@ -14,8 +14,14 @@ jobs:
       - "build"
     uses: "./.github/workflows/test.yml"
   codeql:
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   collect_changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     uses: "./.github/workflows/collect_changes.yml"
-    secrets: "inherit"
 ...
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 742e2457f..209eb8f55 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,5 +1,5 @@
 ---
-name: "pulp-cli CI"
+name: "Pull Request"
 
 on:
   pull_request:
@@ -29,6 +29,10 @@ jobs:
   codeql:
     needs:
       - "lint"
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   check-commits:
     runs-on: "ubuntu-latest"
@@ -36,6 +40,7 @@ jobs:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -60,6 +65,7 @@ jobs:
             fi
           done
         shell: "bash"
+        working-directory: "pulp-cli"
   ready-to-ship:
     # This is a dummy dependent task to have a single entry for the branch protection rules.
     runs-on: "ubuntu-latest"
diff --git a/.github/workflows/pr_checks.yml b/.github/workflows/pr_checks.yml
index c0317567f..f2d8d1c63 100644
--- a/.github/workflows/pr_checks.yml
+++ b/.github/workflows/pr_checks.yml
@@ -1,5 +1,5 @@
 ---
-name: "Pulp CLI PR static checks"
+name: "PR static checks"
 on:
   pull_request_target:
     types: ["opened", "synchronize", "reopened"]
@@ -12,16 +12,21 @@ concurrency:
   group: "${{ github.event.pull_request.number }}-${{ github.workflow }}"
   cancel-in-progress: true
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   apply_labels:
-    runs-on: "ubuntu-latest"
-    name: "Label PR"
     permissions:
       pull-requests: "write"
+    runs-on: "ubuntu-latest"
+    name: "Label PR"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8e9a9fa7c..341236753 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,10 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   build:
     uses: "./.github/workflows/build.yml"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c430d6568..7d54bb2e1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,13 +4,21 @@ name: "Tag Release"
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   release:
     name: "Release"
+    permissions:
+      contents: "write"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli"
           token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
diff --git a/.github/workflows/release_branch.yml b/.github/workflows/release_branch.yml
index f20a5ef3e..f84af1c36 100644
--- a/.github/workflows/release_branch.yml
+++ b/.github/workflows/release_branch.yml
@@ -3,12 +3,22 @@ name: "Create Release Branch"
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 jobs:
   create-release-branch:
+    permissions:
+      contents: "write"
+      issues: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli"
           token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -30,17 +40,17 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Bump dev-version"
           body: ""
           branch: "bump_version"
           delete-branch: true
+          path: "pulp-cli"
       - name: "Mark PR automerge"
         run: |
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
       - name: "Add Backport Label for new Branch"
         uses: "actions/github-script@v8"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7b7d697e1..c9c9b0e26 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,10 @@ name: "Test"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli"
+
 env:
   COLORTERM: "yes"
   TERM: "xterm-256color"
@@ -16,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli"
       - name: "Download wheels"
         uses: "actions/download-artifact@v8"
         with:
@@ -69,6 +75,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli"
       - name: "Download wheels"
         uses: "actions/download-artifact@v8"
         with:
diff --git a/cookiecutter/ci/templates/macros b/cookiecutter/ci/templates/macros
index 64a0529da..6bd7e4ae0 100644
--- a/cookiecutter/ci/templates/macros
+++ b/cookiecutter/ci/templates/macros
@@ -6,13 +6,19 @@ concurrency:
   cancel-in-progress: true
 {%- endmacro -%}
 
-{%- macro checkout(deep=false) -%}
+{%- macro checkout(deep=false, release_token=false) -%}
 - name: "Checkout"
   uses: "actions/checkout@v6"
-  {%- if deep %}
   with:
+    path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+    {%- if deep %}
     fetch-depth: 0
-  {%- endif %}
+    {%- endif %}
+    {%- if release_token %}
+    {%- raw %}
+    token: "${{ secrets.RELEASE_TOKEN }}"
+    {%- endraw %}
+    {%- endif %}
 {%- endmacro -%}
 
 {%- macro download_wheels() -%}
@@ -43,3 +49,29 @@ concurrency:
     git config user.name pulpbot
     git config user.email pulp-infra@redhat.com
 {%- endmacro -%}
+
+{%- macro create_pr(branch, title, release_token=false) -%}
+- name: "Create Pull Request"
+  uses: "peter-evans/create-pull-request@v8"
+  id: "create_pr"
+  with:
+    title: "{{ title }}"
+    body: ""
+    branch: "{{ branch }}"
+    delete-branch: true
+    path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+    {%- if release_token %}
+    {%- raw %}
+    token: "${{ secrets.RELEASE_TOKEN }}"
+    {%- endraw %}
+    {%- endif %}
+{%- raw %}
+- name: "Mark PR automerge"
+  run: |
+    gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
+  if: "steps.create_pr.outputs.pull-request-number"
+  env:
+    GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+  continue-on-error: true
+{%- endraw %}
+{%- endmacro -%}
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.ci/scripts/release.sh b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.ci/scripts/release.sh
index a9c3644a9..41d26774f 100755
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.ci/scripts/release.sh	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.ci/scripts/release.sh	
@@ -23,4 +23,4 @@ towncrier build --yes --version "${NEW_VERSION}"
 bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty
 bump-my-version bump patch --commit
 
-git push origin "${BRANCH}" "${NEW_VERSION}"
+git push --atomic origin "${BRANCH}" "${NEW_VERSION}"
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/build.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/build.yml
index 310c1a8d7..a20168ca0 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/build.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/build.yml	
@@ -5,6 +5,10 @@ name: "Build"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   build:
     runs-on: "ubuntu-latest"
@@ -15,14 +19,14 @@ jobs:
       - name: "Build wheels"
         run: |
           make build
-          touch .root
+          touch ../.root
       - name: "Upload wheels"
         uses: "actions/upload-artifact@v6"
         with:
           name: "pulp_cli_packages"
           path: |
             .root
-            dist/
+            pulp-cli{{ cookiecutter.__app_label_suffix }}/dist/
           if-no-files-found: "error"
           retention-days: 5
 ...
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/codeql.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/codeql.yml
index 08b77fe2c..0dd24bef1 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/codeql.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/codeql.yml	
@@ -3,11 +3,12 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches:
-      - "main"
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   analyze:
     name: "Analyze"
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/collect_changes.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/collect_changes.yml
index 93f2b8d5a..f3452ccfd 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/collect_changes.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/collect_changes.yml	
@@ -5,8 +5,15 @@ on:
   workflow_call:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   collect-changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       {{ macros.checkout(deep=true) | indent(6) }}
@@ -16,22 +23,5 @@ jobs:
       - name: "Collect changes"
         run: |
           uv run --script .ci/scripts/collect_changes.py
-      {%- raw %}
-      - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8"
-        id: "create_pr"
-        with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          title: "Update Changelog"
-          body: ""
-          branch: "update_changes"
-          delete-branch: true
-      - name: "Mark PR automerge"
-        run: |
-          gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
-        if: "steps.create_pr.outputs.pull-request-number"
-        env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
-        continue-on-error: true
-      {%- endraw %}
+      {{ macros.create_pr("update_changes", "Update Changelog") | indent(6) }}
 ...
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/cookiecutter.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/cookiecutter.yml
index ea68f9d44..2a4f64c9f 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/cookiecutter.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/cookiecutter.yml	
@@ -12,95 +12,54 @@ defaults:
 
 jobs:
   update-ci:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
         with:
           repository: "pulp/pulp-cli"
-          path: "pulp-cli"
-      - uses: "actions/checkout@v6"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
-          path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+          ref: "main"
+          path: "pulp-cli_cc"
+      {#- This job needs the RELEASE_TOKEN in order to change workflow files. #}
+      {{ macros.checkout(release_token=true) | indent(6) }}
       {{ macros.setup_python() | indent(6) }}
       {{ macros.install_uv() | indent(6) }}
       {{ macros.setup_git() | indent(6) }}
       - name: "Apply cookiecutter templates"
         run: |
-          uv run ../pulp-cli/cookiecutter/apply_templates.py
+          uv run ../pulp-cli_cc/cookiecutter/apply_templates.py
           if [ "$(git status --porcelain)" ]
           then
             git add .
             git commit -m "Update cookiecutter"
           fi
-      - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8"
-        id: "create_pr"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
-          title: "Update cookiecutter"
-          body: ""
-          branch: "update_cookiecutter"
-          delete-branch: true
-          path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
-      {%- raw %}
-      - name: "Mark PR automerge"
-        run: |
-          gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
-        if: "steps.create_pr.outputs.pull-request-number"
-        env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
-        continue-on-error: true
-      {%- endraw %}
+      {{ macros.create_pr("update_cookiecutter", "Update cookiecutter", release_token=true) | indent(6) }}
   {%- if cookiecutter.app_label %}
   update-dependencies:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
         with:
           repository: "pulp/pulp-cli"
-          path: "pulp-cli"
-      - uses: "actions/checkout@v6"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
-          path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+          branch: "main"
+          path: "pulp-cli_cc"
+      {{ macros.checkout() | indent(6) }}
       {{ macros.setup_python() | indent(6) }}
       {{ macros.install_uv() | indent(6) }}
       {{ macros.setup_git() | indent(6) }}
       - name: "Apply cookiecutter templates"
         run: |
-          uv run ../pulp-cli/cookiecutter/update_pulp_cli.py
+          uv run ../pulp-cli_cc/cookiecutter/update_pulp_cli.py
           if [ "$(git status --porcelain)" ]
           then
             git add .
             git commit -m "Update CLI and GLUE"
           fi
-      - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8"
-        id: "create_pr"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
-          title: "Update CLI and GLUE"
-          body: ""
-          branch: "update_cli"
-          delete-branch: true
-          path: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
-      {%- raw %}
-      - name: "Mark PR automerge"
-        run: |
-          gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
-        if: "steps.create_pr.outputs.pull-request-number"
-        env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
-        continue-on-error: true
-      {%- endraw %}
+      {{ macros.create_pr("update_cli", "Update CLI and GLUE") | indent(6) }}
     {%- endif %}
 ...
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/lint.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/lint.yml
index 30c85e8bc..37633416d 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/lint.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/lint.yml	
@@ -5,6 +5,10 @@ name: "Lint"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   lint:
     runs-on: "ubuntu-latest"
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/nightly.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/nightly.yml
index cf39225a1..8ec5b2609 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/nightly.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/nightly.yml	
@@ -1,5 +1,5 @@
 ---
-name: "pulp-cli Nightly"
+name: "Nightly"
 
 on:
   schedule:
@@ -14,8 +14,14 @@ jobs:
       - "build"
     uses: "./.github/workflows/test.yml"
   codeql:
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   collect_changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     uses: "./.github/workflows/collect_changes.yml"
-    secrets: "inherit"
 ...
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr.yml
index 35281832b..a139e5ddd 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr.yml	
@@ -1,6 +1,6 @@
 {%- import 'macros' as macros with context -%}
 ---
-name: "pulp-cli CI"
+name: "Pull Request"
 
 on:
   pull_request:
@@ -30,6 +30,10 @@ jobs:
   codeql:
     needs:
       - "lint"
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   check-commits:
     runs-on: "ubuntu-latest"
@@ -53,6 +57,7 @@ jobs:
             fi
           done
         shell: "bash"
+        working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
   ready-to-ship:
     # This is a dummy dependent task to have a single entry for the branch protection rules.
     runs-on: "ubuntu-latest"
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr_checks.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr_checks.yml
index 718c7eb37..5d386c6f2 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr_checks.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/pr_checks.yml	
@@ -1,6 +1,6 @@
 {%- import 'macros' as macros with context -%}
 ---
-name: "Pulp CLI PR static checks"
+name: "PR static checks"
 on:
   pull_request_target:
     types: ["opened", "synchronize", "reopened"]
@@ -15,12 +15,16 @@ concurrency:
   {%- endraw %}
   cancel-in-progress: true
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   apply_labels:
-    runs-on: "ubuntu-latest"
-    name: "Label PR"
     permissions:
       pull-requests: "write"
+    runs-on: "ubuntu-latest"
+    name: "Label PR"
     steps:
       {{ macros.checkout(deep=true) | indent(6) }}
       {{ macros.setup_python() | indent(6) }}
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/publish.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/publish.yml
index f380fc612..e720a475c 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/publish.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/publish.yml	
@@ -7,6 +7,10 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   build:
     uses: "./.github/workflows/build.yml"
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release.yml
index 165a14c3e..283a2407c 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release.yml	
@@ -5,16 +5,18 @@ name: "Tag Release"
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   release:
     name: "Release"
+    permissions:
+      contents: "write"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
+      {{ macros.checkout(release_token=true) | indent(6) }}
       {{ macros.setup_python() | indent(6) }}
       {{ macros.install_uv() | indent(6) }}
       {{ macros.setup_git() | indent(6) }}
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release_branch.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release_branch.yml
index 7bc27a416..4b94ce130 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release_branch.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/release_branch.yml	
@@ -4,43 +4,26 @@ name: "Create Release Branch"
 on:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 jobs:
   create-release-branch:
+    permissions:
+      contents: "write"
+      issues: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
+      {{ macros.checkout(release_token=true) | indent(6) }}
       {{ macros.setup_python() | indent(6) }}
       {{ macros.install_uv() | indent(6) }}
       {{ macros.setup_git() | indent(6) }}
       - name: "Create Release Branch"
         run: |
           uv run --with bump-my-version~=0.20.0 .ci/scripts/create_release_branch.sh
-      - name: "Create Pull Request"
-        uses: "peter-evans/create-pull-request@v8"
-        id: "create_pr"
-        with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          title: "Bump dev-version"
-          body: ""
-          branch: "bump_version"
-          delete-branch: true
-          {%- endraw %}
-      - name: "Mark PR automerge"
-        run: |
-          {%- raw %}
-          gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
-          {%- endraw %}
-        if: "steps.create_pr.outputs.pull-request-number"
-        env:
-          {%- raw %}
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
-        continue-on-error: true
+      {{ macros.create_pr("bump_version", "Bump dev-version") | indent(6) }}
       - name: "Add Backport Label for new Branch"
         uses: "actions/github-script@v8"
         with:
diff --git a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/test.yml b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/test.yml
index ae13144e7..b9499db4e 100644
--- a/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/test.yml	
+++ b/cookiecutter/ci/{{ cookiecutter.__project_name }}/.github/workflows/test.yml	
@@ -5,6 +5,10 @@ name: "Test"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli{{ cookiecutter.__app_label_suffix }}"
+
 env:
   COLORTERM: "yes"
   TERM: "xterm-256color"