diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index be1e1e79..edfb603d 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -10,8 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+# built-in GitHub token/permissions are not used
+permissions: {}
 
 env:
   FEEDBACK_LBL: pending::feedback
@@ -19,8 +19,6 @@ env:
 
 jobs:
   # NOTE: will update label if anyone responds, not just the author/reporter
-  # TODO: create conda-issue-sorting team and modify this to toggle label based on
-  # whether a non-issue-sorting engineer commented
   pending_support:
     name: Update pending support label
     # if [pending::feedback] and anyone responds
@@ -29,18 +27,14 @@ jobs:
       && !github.event.issue.pull_request
       && contains(github.event.issue.labels.*.name, 'pending::feedback')
     runs-on: ubuntu-slim
-    permissions:
-      contents: read
-      issues: write  # Required to remove and add issue triage labels.
     steps:
       # remove [pending::feedback]
-      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
-        with:
-          labels: ${{ env.FEEDBACK_LBL }}
-          github_token: ${{ secrets.PROJECT_TOKEN }}
+      - run: gh issue edit --remove-label "${FEEDBACK_LBL}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+
       # add [pending::support], if still open
-      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
-        if: github.event.issue.state == 'open'
-        with:
-          labels: ${{ env.SUPPORT_LBL }}
-          github_token: ${{ secrets.PROJECT_TOKEN }}
+      - if: github.event.issue.state == 'open'
+        run: gh issue edit --add-label "${SUPPORT_LBL}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2c43c061..3783d96f 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -40,12 +40,13 @@ jobs:
             days-before-issue-stale: 90
             days-before-issue-close: 21
     steps:
-      - uses: conda/actions/read-yaml@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
-        id: read_yaml
+      - uses: conda/actions/read-file@7f6830b1428a9bd47f0b068892c77eae95207037 # v26.1.0
+        id: read_messages
         with:
           path: https://raw.githubusercontent.com/conda/infra/main/.github/messages.yml
+          parser: yaml
 
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         id: stale
         with:
           # Only issues with these labels are checked whether they are stale
@@ -61,7 +62,7 @@ jobs:
           days-before-pr-close: 30
 
           # Comment on the staled issues
-          stale-issue-message: ${{ fromJSON(steps.read_yaml.outputs.value)['stale-issue'] }}
+          stale-issue-message: ${{ fromJSON(steps.read_messages.outputs.content)['stale-issue'] }}
           # Label to apply on staled issues
           stale-issue-label: stale
           # Label to apply on closed issues
@@ -70,7 +71,7 @@ jobs:
           close-issue-reason: not_planned
 
           # Comment on the staled PRs
-          stale-pr-message: ${{ fromJSON(steps.read_yaml.outputs.value)['stale-pr'] }}
+          stale-pr-message: ${{ fromJSON(steps.read_messages.outputs.content)['stale-pr'] }}
           # Label to apply on staled PRs
           stale-pr-label: stale
           # Label to apply on closed PRs