diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 796ea5a..a6a0366 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -26,15 +29,12 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 2
+          filter: blob:none # We don't need all blobs
 
       - uses: actions/cache@v4.0.0
         with:
           path: ~/.nuget/packages
-          # Look to see if there is a cache hit for the corresponding requirements file
-          # key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
           key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets') }}
-          # restore-keys: |
-          #   ${{ runner.os }}-nuget
 
       - name: restore
         run: dotnet restore
@@ -55,9 +55,6 @@ jobs:
     needs: [test]
     runs-on: windows-latest
     timeout-minutes: 15
-    permissions:
-      packages: write
-      contents: write
 
     env:
       CONFIGURATION: Release
@@ -66,15 +63,12 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0 # needed so minver finds git tags https://github.com/actions/checkout/issues/172
+          filter: blob:none # We don't need all blobs
 
       - uses: actions/cache@v4.0.0
         with:
           path: ~/.nuget/packages
-          # Look to see if there is a cache hit for the corresponding requirements file
-          # key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
           key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets') }}
-          # restore-keys: |
-          #   ${{ runner.os }}-nuget
 
       - name: restore
         run: dotnet restore
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16571b6..104d2f1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,14 +12,16 @@ env:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
+
+permissions:
+  contents: read
 
 jobs:
   release:
     runs-on: windows-latest
     timeout-minutes: 15
     permissions:
-      packages: write
       contents: write
 
     env:
@@ -29,15 +31,14 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0 # needed so minver finds git tags https://github.com/actions/checkout/issues/172
+          filter: blob:none # We don't need all blobs
 
       - uses: actions/cache@v4.0.0
         with:
           path: ~/.nuget/packages
-          # Look to see if there is a cache hit for the corresponding requirements file
-          # key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
           key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props', '**/*.targets') }}
-          # restore-keys: |
-          #   ${{ runner.os }}-nuget
+          restore-keys: |
+            ${{ runner.os }}-nuget
           
       - name: restore
         run: dotnet restore
@@ -53,23 +54,24 @@ jobs:
           name: packages
           path: bin/*.nupkg
 
-      # - name: deploy github.com
-      #   run: |
-      #     dotnet nuget add source --username $NUGET_USR --password $NUGET_PSW --store-password-in-clear-text --name github $NUGET_SOURCE
-      #     find bin -name '*.nupkg' | xargs dotnet nuget push -s github --skip-duplicate --force-english-output
-      #   shell: bash
-      #   env:
-      #     NUGET_SOURCE: https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json
-      #     NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
-
       - name: deploy nuget.org
         run: find bin -name '*.nupkg' | xargs dotnet nuget push -s $NUGET_SOURCE -k $NUGET_KEY --skip-duplicate --force-english-output
         shell: bash
         env:
           NUGET_SOURCE: https://api.nuget.org/v3/index.json
           NUGET_KEY: ${{ secrets.NUGET_API_KEY }}
+          
+      - name: prepare version
+        run: echo VERSION=${GITHUB_REF_NAME#v} >> $GITHUB_ENV
 
-      - uses: marvinpinto/action-automatic-releases@v1.2.1
+      - name: Generate changelog with git-cliff
+        uses: tj-actions/git-cliff@b8b856ab6829a813d4ed58476b6faaec9c2b24ef # v1.4.2
+        with:
+          args: --latest --strip all
+          output: 'CHANGELOG.md'
+      
+      - uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
         with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          bodyFile: 'CHANGELOG.md'
+          name: ${{ env.VERSION }}
           prerelease: ${{ contains(github.ref_name, '-') }}