diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0ca3821..650c893 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,4 @@
-name: Publish NuGet Package
+name: Publish NuGet Packages
 
 on:
   release:
@@ -11,7 +11,8 @@ env:
 jobs:
   publish:
     permissions:
-      id-token: write  # enable GitHub OIDC token issuance for this job
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -23,12 +24,11 @@ jobs:
         shell: bash
         run: bash scripts/pack.sh --configuration Release --runtime linux-x64 --output "${{ env.NuGetDirectory }}"
 
-      # Get a short-lived NuGet API key
       - name: NuGet login (OIDC → temp API key)
         uses: NuGet/login@v1
         id: login
         with:
-          user: ${{ vars.NUGET_USER }}
+          user: ling921
 
       - name: Publish to NuGet
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7b130f8..17b6277 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,12 +5,15 @@ on:
   pull_request:
     branches:
       - master
-  push:
-    branches:
-      - master
+
+concurrency:
+  group: tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps: