diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1995bad..a59e7a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check-license:
     name: Check License Headers
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 9485fb8..e782b6b 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -20,6 +20,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   integration:
     name: Integration Tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 016841d..30b4960 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,6 +18,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Lint & Test
@@ -60,6 +63,13 @@ jobs:
           python-version: "3.14"
           enable-cache: true
 
+      - name: Set version from release tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          uv version "$VERSION"
+
       - name: Build sdist and wheel
         run: uv build
 
diff --git a/pyproject.toml b/pyproject.toml
index a2ed0e7..fbfcddc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,6 +24,10 @@ dependencies = [
     "stackit-authorization>=0.9.0",
 ]
 
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
 [dependency-groups]
 dev = [
     "pytest>=8.0.0",