diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 310c17d..74e293c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -16,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
         with:
           components: rustfmt
@@ -27,6 +36,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
         with:
           components: clippy
@@ -43,6 +54,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@1.91
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --workspace --all-targets --all-features
diff --git a/Cargo.toml b/Cargo.toml
index 0e196c4..bfe4323 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,4 +36,4 @@ push = false
 publish = false
 tag-name = "v{{version}}"
 pre-release-commit-message = "release: v{{version}}"
-pre-release-hook = ["git", "cliff", "-o", "CHANGELOG.md", "--latest"]
+pre-release-hook = ["git", "cliff", "-o", "CHANGELOG.md", "--tag", "v{{version}}"]
diff --git a/src/banner.rs b/src/banner.rs
index b625d44..3561f4d 100644
--- a/src/banner.rs
+++ b/src/banner.rs
@@ -1,4 +1,4 @@
-use color_print::{cprintln, cstr};
+use color_print::cprintln;
 
 use crate::Config;
 
diff --git a/src/cmds/check.rs b/src/cmds/check.rs
index 0485f69..71e2d03 100644
--- a/src/cmds/check.rs
+++ b/src/cmds/check.rs
@@ -61,7 +61,7 @@ fn text_output(
         println!("You have {} update/s to install 📦", updates.len());
     } else {
         for update in updates {
-            print_update(&update, &manifest)?;
+            print_update(update, manifest)?;
         }
     }
 
diff --git a/src/main.rs b/src/main.rs
index 1c8f3c0..da62480 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,3 +1,4 @@
+#![allow(dead_code)]
 use std::path::PathBuf;
 
 use anyhow::{Context, Result};
@@ -175,7 +176,7 @@ async fn main() -> anyhow::Result<()> {
         github_token: cli.github_token,
     };
 
-    let skip_banner = cli.command.as_ref().map_or(false, |c| c.skip_banner());
+    let skip_banner = cli.command.as_ref().is_some_and(|c| c.skip_banner());
 
     if !skip_banner {
         banner::print_banner(&config);
diff --git a/src/manifest.rs b/src/manifest.rs
index 1246702..a04b201 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -20,18 +20,13 @@ pub fn build_octocrab(config: &Config) -> anyhow::Result<Octocrab> {
     builder.build().context("building octocrab client")
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub enum Installer {
+    #[default]
     GithubRelease,
     Instructions,
 }
 
-impl Default for Installer {
-    fn default() -> Self {
-        Self::GithubRelease
-    }
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Tool {
     pub name: String,
diff --git a/src/updates.rs b/src/updates.rs
index 51e5c31..6b697c0 100644
--- a/src/updates.rs
+++ b/src/updates.rs
@@ -50,10 +50,10 @@ async fn evaluate_update(tool: &Tool, config: &Config) -> anyhow::Result<Option<
     let current = find_installed_version(tool, config).await?;
     let requested = VersionReq::parse(&tool.version)?;
 
-    if let Some(current) = &current {
-        if requested.matches(&current) {
-            return Ok(None);
-        }
+    if let Some(current) = &current
+        && requested.matches(current)
+    {
+        return Ok(None);
     }
 
     Ok(Some(Update {