diff --git a/.github/workflows/bot_pr_approval.yaml b/.github/workflows/bot_pr_approval.yaml
index e38c584..8cf0e8e 100644
--- a/.github/workflows/bot_pr_approval.yaml
+++ b/.github/workflows/bot_pr_approval.yaml
@@ -7,3 +7,5 @@ jobs:
   bot_pr_approval:
     uses: canonical/operator-workflows/.github/workflows/bot_pr_approval.yaml@main
     secrets: inherit
+    permissions:
+      pull-requests: write
diff --git a/.github/workflows/integration_test.yaml b/.github/workflows/integration_test.yaml
index 8801212..e9bad56 100644
--- a/.github/workflows/integration_test.yaml
+++ b/.github/workflows/integration_test.yaml
@@ -7,6 +7,10 @@ on:
 
 jobs:
   integration-tests:
+    permissions:
+      contents: read
+      packages: write
+      pull-requests: write
     uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main
     secrets: inherit
     with:
@@ -18,6 +22,8 @@ jobs:
       self-hosted-runner: true
       with-uv: true
   allure-report:
+    permissions:
+      contents: write
     if: ${{ !cancelled() && github.event_name == 'schedule' }}
     needs:
     - integration-tests
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6446a3c..46f001c 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -6,6 +6,9 @@ on:
 jobs:
   unit-tests:
     uses: canonical/operator-workflows/.github/workflows/test.yaml@main
+    permissions:
+      contents: read
+      pull-requests: write
     secrets: inherit
     with:
       with-uv: true
diff --git a/pyproject.toml b/pyproject.toml
index 7dd2905..5b382b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,7 @@ classifiers = [
 ]
 dependencies = [
   "cosl==1.9.1",
-  "ops==3.7.0",
+  "ops==3.7.1",
   "tabulate==0.10.0",
 ]
 
diff --git a/uv.lock b/uv.lock
index 3f9391f..60bda40 100644
--- a/uv.lock
+++ b/uv.lock
@@ -455,7 +455,7 @@ unit = [
 [package.metadata]
 requires-dist = [
     { name = "cosl", specifier = "==1.9.1" },
-    { name = "ops", specifier = "==3.7.0" },
+    { name = "ops", specifier = "==3.7.1" },
     { name = "tabulate", specifier = "==0.10.0" },
 ]
 
@@ -1259,16 +1259,16 @@ wheels = [
 
 [[package]]
 name = "ops"
-version = "3.7.0"
+version = "3.7.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "opentelemetry-api" },
     { name = "pyyaml" },
     { name = "websocket-client" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7b/af/57895c8b7c23bf98e07d6306d24d2775a1e89fc2a4c8c1bd934dba3acdc2/ops-3.7.0.tar.gz", hash = "sha256:15f04b2fcf1d8bc966cd4405b68a2c71fa24c06f234d5003e89cc4f18ee51a45", size = 580141, upload-time = "2026-03-30T05:17:16.285Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/42/60/ad398d889fd03b1b4f950fad54ad4d0cf7a81fde21f9866a8139c8f03684/ops-3.7.1.tar.gz", hash = "sha256:1765bf6d1cff376ea27608542e183b055c89f2c5f54bca602072bcc817195abc", size = 582424, upload-time = "2026-05-28T04:13:43.906Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/35/b0/19722b4b51696fbca41d3454f3dd3a73e89951303487b47280c6f3e277d4/ops-3.7.0-py3-none-any.whl", hash = "sha256:7050d5e629ac17de9d443e64f4ad09857e8012c9012c8ba66c9e765899d50bd1", size = 211865, upload-time = "2026-03-30T05:17:11.644Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/20/742e720af65f9ad23ae0cfe140502a10b2e74da6c63773f3999dad793661/ops-3.7.1-py3-none-any.whl", hash = "sha256:559dc6770e551da5f4b9686a5605ed927c140182eb38bcc31c1c531c2f98923a", size = 212723, upload-time = "2026-05-28T04:13:39.845Z" },
 ]
 
 [[package]]