diff --git a/.changeset/changelog.cjs b/.changeset/changelog.cjs
deleted file mode 100644
index 7abecaf..0000000
--- a/.changeset/changelog.cjs
+++ /dev/null
@@ -1,177 +0,0 @@
-const {
-  getInfo,
-  getInfoFromPullRequest,
-} = require('@changesets/get-github-info');
-
-/**
- * Bold the scope of the changelog entry.
- *
- * @param {string} firstLine
- */
-const boldScope = (firstLine) => firstLine.replace(/^([^:]+): /, '**$1:** ');
-
-/**
- * Adapted from `@changesets/cli`.
- *
- * {@link https://github.com/atlassian/changesets/blob/%40changesets/cli%402.17.0/packages/cli/src/changelog/index.ts}
- *
- * @type import('@changesets/types').ChangelogFunctions
- */
-const defaultChangelogFunctions = {
-  getDependencyReleaseLine: async (changesets, dependenciesUpdated) => {
-    if (dependenciesUpdated.length === 0) {
-      return '';
-    }
-
-    const changesetLinks = changesets.map(
-      (changeset) => `- Updated dependencies [${changeset.commit}]`,
-    );
-
-    const updatedDependenciesList = dependenciesUpdated.map(
-      (dependency) => `  - ${dependency.name}@${dependency.newVersion}`,
-    );
-
-    return [...changesetLinks, ...updatedDependenciesList].join('\n');
-  },
-  getReleaseLine: async (changeset) => {
-    const [firstLine, ...futureLines] = changeset.summary
-      .split('\n')
-      .map((l) => l.trimRight());
-
-    const formattedFirstLine = boldScope(firstLine);
-
-    const suffix = changeset.commit;
-
-    return `\n\n- ${formattedFirstLine}${
-      suffix ? ` (${suffix})` : ''
-    }\n${futureLines.map((l) => `  ${l}`).join('\n')}`;
-  },
-};
-
-/**
- * Adapted from `@changesets/changelog-github`.
- *
- * {@link https://github.com/atlassian/changesets/blob/%40changesets/changelog-github%400.4.1/packages/changelog-github/src/index.ts}
- *
- * @type import('@changesets/types').ChangelogFunctions
- */
-const gitHubChangelogFunctions = {
-  getDependencyReleaseLine: async (
-    changesets,
-    dependenciesUpdated,
-    options,
-  ) => {
-    if (!options.repo) {
-      throw new Error(
-        'Please provide a repo to this changelog generator like this:\n"changelog": ["./changelog.js", { "repo": "org/repo" }]',
-      );
-    }
-    if (dependenciesUpdated.length === 0) {
-      return '';
-    }
-
-    const changesetLink = `- Updated dependencies [${(
-      await Promise.all(
-        changesets.map(async (cs) => {
-          if (cs.commit) {
-            const info = await getInfo({
-              repo: options.repo,
-              commit: cs.commit,
-            });
-            return info.links.commit;
-          }
-        }),
-      )
-    )
-      .filter((_) => _)
-      .join(', ')}]:`;
-
-    const updatedDependenciesList = dependenciesUpdated.map(
-      (dependency) => `  - ${dependency.name}@${dependency.newVersion}`,
-    );
-
-    return [changesetLink, ...updatedDependenciesList].join('\n');
-  },
-  getReleaseLine: async (changeset, _type, options) => {
-    if (!options || !options.repo) {
-      throw new Error(
-        'Please provide a repo to this changelog generator like this:\n"changelog": ["./changelog.js", { "repo": "org/repo" }]',
-      );
-    }
-
-    /** @type number | undefined */
-    let prFromSummary;
-    /** @type string | undefined */
-    let commitFromSummary;
-
-    const replacedChangelog = changeset.summary
-      .replace(/^\s*(?:pr|pull|pull\s+request):\s*#?(\d+)/im, (_, pr) => {
-        const num = Number(pr);
-        if (!isNaN(num)) {
-          prFromSummary = num;
-        }
-        return '';
-      })
-      .replace(/^\s*commit:\s*([^\s]+)/im, (_, commit) => {
-        commitFromSummary = commit;
-        return '';
-      })
-      .replace(/^\s*(?:author|user):\s*@?([^\s]+)/gim, '')
-      .trim();
-
-    const [firstLine, ...futureLines] = replacedChangelog
-      .split('\n')
-      .map((l) => l.trimRight());
-
-    const links = await (async () => {
-      if (prFromSummary !== undefined) {
-        const info = await getInfoFromPullRequest({
-          repo: options.repo,
-          pull: prFromSummary,
-        });
-        if (commitFromSummary) {
-          return {
-            ...info.links,
-            commit: `[\`${commitFromSummary}\`](https://github.com/${options.repo}/commit/${commitFromSummary})`,
-          };
-        }
-        return info.links;
-      }
-      const commitToFetchFrom = commitFromSummary || changeset.commit;
-      if (commitToFetchFrom) {
-        const info = await getInfo({
-          repo: options.repo,
-          commit: commitToFetchFrom,
-        });
-        return info.links;
-      }
-      return {
-        commit: null,
-        pull: null,
-        user: null,
-      };
-    })();
-
-    const formattedFirstLine = boldScope(firstLine);
-
-    const suffix = links.pull ?? links.commit;
-
-    return [
-      `\n- ${formattedFirstLine}${suffix ? ` (${suffix})` : ''}`,
-      ...futureLines.map((l) => `  ${l}`),
-    ].join('\n');
-  },
-};
-
-if (process.env.GITHUB_TOKEN) {
-  module.exports = gitHubChangelogFunctions;
-} else {
-  // eslint-disable-next-line no-console
-  console.warn(
-    `Defaulting to Git-based versioning.
-Enable GitHub-based versioning by setting the GITHUB_TOKEN environment variable.
-This requires a GitHub personal access token with the \`public_repo\` scope: https://github.com/settings/tokens/new`,
-  );
-
-  module.exports = defaultChangelogFunctions;
-}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5495e7a..6f638d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ jobs:
     name: Publish latest
     if: github.event_name == 'push'
     permissions:
+      contents: read
       id-token: write
     runs-on: ubuntu-latest
     steps:
@@ -20,7 +21,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          token: ${{ secrets.SEEK_OSS_CI_GITHUB_TOKEN }}
 
       - name: Set up pnpm
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -45,6 +45,7 @@ jobs:
     name: Publish Snapshot
     if: github.event_name == 'workflow_dispatch'
     permissions:
+      contents: read
       id-token: write
     runs-on: ubuntu-latest
     steps:
@@ -52,7 +53,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          token: ${{ secrets.SEEK_OSS_CI_GITHUB_TOKEN }}
 
       - name: Set up pnpm
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0