diff --git a/.github/workflows/check-candidate-release.yml b/.github/workflows/check-candidate-release.yml
index 4b7c2a981..57e8c0384 100644
--- a/.github/workflows/check-candidate-release.yml
+++ b/.github/workflows/check-candidate-release.yml
@@ -5,6 +5,9 @@ on:
     - cron: '59 4 * * 2'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check_candidates:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/code-linter.yml b/.github/workflows/code-linter.yml
index 5b88766fe..dd7e1c633 100644
--- a/.github/workflows/code-linter.yml
+++ b/.github/workflows/code-linter.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - dev
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/issue-metrics.yml b/.github/workflows/issue-metrics.yml
index a2b067b5b..1444c53a1 100644
--- a/.github/workflows/issue-metrics.yml
+++ b/.github/workflows/issue-metrics.yml
@@ -1,4 +1,7 @@
 name: Monthly issue metrics
+permissions:
+  contents: write
+  issues: read
 on:
   workflow_dispatch:
   schedule:
diff --git a/.github/workflows/macos-release-build.yml b/.github/workflows/macos-release-build.yml
index 28f2c1878..e566641d9 100644
--- a/.github/workflows/macos-release-build.yml
+++ b/.github/workflows/macos-release-build.yml
@@ -1,4 +1,6 @@
 name: macOS Release Build
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
index 2d18f0dcc..9dd93d598 100644
--- a/.github/workflows/pr-test.yml
+++ b/.github/workflows/pr-test.yml
@@ -1,4 +1,6 @@
 name: Pull request test
+permissions:
+  contents: read
 
 on:
   pull_request:
diff --git a/.github/workflows/windows-profile-build.yml b/.github/workflows/windows-profile-build.yml
index 810c3fcb3..0a5e78d91 100644
--- a/.github/workflows/windows-profile-build.yml
+++ b/.github/workflows/windows-profile-build.yml
@@ -1,5 +1,8 @@
 name: Windows PGO Builds
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/windows-release-build.yml b/.github/workflows/windows-release-build.yml
index 91409f8fb..747d86c51 100644
--- a/.github/workflows/windows-release-build.yml
+++ b/.github/workflows/windows-release-build.yml
@@ -1,5 +1,8 @@
 name: Windows Release Build
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
diff --git a/src/browser/components/preferences/zen-settings.js b/src/browser/components/preferences/zen-settings.js
index f26ab7d19..512d2e91d 100644
--- a/src/browser/components/preferences/zen-settings.js
+++ b/src/browser/components/preferences/zen-settings.js
@@ -275,7 +275,7 @@ var gZenMarketplaceManager = {
     const themeList = document.createElement('div');
 
     for (const theme of Object.values(themes).sort((a, b) => a.name.localeCompare(b.name))) {
-      const sanitizedName = `theme-${theme.name?.replaceAll(/\s/g, '-')?.replaceAll(/[^A-z_-]+/g, '')}`;
+      const sanitizedName = `theme-${theme.name?.replaceAll(/\s/g, '-')?.replaceAll(/[^A-Za-z_-]+/g, '')}`;
       const isThemeEnabled = theme.enabled === undefined || theme.enabled;
       const fragment = window.MozXULElement.parseXULToFragment(`
         <vbox class="zenThemeMarketplaceItem">
diff --git a/src/zen/mods/ZenThemesCommon.mjs b/src/zen/mods/ZenThemesCommon.mjs
index 82632939a..14ce3593d 100644
--- a/src/zen/mods/ZenThemesCommon.mjs
+++ b/src/zen/mods/ZenThemesCommon.mjs
@@ -76,7 +76,7 @@ var ZenThemesCommon = {
 
       for (let [entry, label] of Object.entries(preferences)) {
         const [_, negation = '', os = '', property] =
-          /(!?)(?:(macos|windows|linux):)?([A-z0-9-_.]+)/g.exec(entry);
+          /(!?)(?:(macos|windows|linux):)?([A-Za-z0-9-_.]+)/g.exec(entry);
         const isNegation = negation === '!';
 
         if (
diff --git a/src/zen/mods/ZenThemesImporter.mjs b/src/zen/mods/ZenThemesImporter.mjs
index 65bd00888..2b97602d7 100644
--- a/src/zen/mods/ZenThemesImporter.mjs
+++ b/src/zen/mods/ZenThemesImporter.mjs
@@ -249,7 +249,7 @@ var gZenThemesImporter = new (class {
   writeToDom(themesWithPreferences) {
     for (const browser of ZenMultiWindowFeature.browsers) {
       for (const { enabled, preferences, name } of themesWithPreferences) {
-        const sanitizedName = `theme-${name?.replaceAll(/\s/g, '-')?.replaceAll(/[^A-z_-]+/g, '')}`;
+        const sanitizedName = `theme-${name?.replaceAll(/\s/g, '-')?.replaceAll(/[^A-Za-z_-]+/g, '')}`;
 
         if (enabled !== undefined && !enabled) {
           const element = browser.document.getElementById(sanitizedName);