diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 801a7d7aa..3a8a814e1 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   generate-version:
     name: Generate Version
@@ -14,7 +17,7 @@ jobs:
       tag: ${{ steps.version.outputs.tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -34,7 +37,7 @@ jobs:
     needs: generate-version
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Go
         uses: actions/setup-go@v6
@@ -45,7 +48,7 @@ jobs:
         run: make build-all VERSION=${{ needs.generate-version.outputs.version }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: picoclaw-binaries
           path: build/*
@@ -53,17 +56,20 @@ jobs:
   build-docker:
     name: Build Docker
     runs-on: ubuntu-latest
+    needs: generate-version
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Generate lowercase repo
         id: repo
         run: echo "repo=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
 
-      - name: Generate date tag
-        id: date
-        run: echo "date=$(date +%Y%m%d)" >> $GITHUB_OUTPUT
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -82,21 +88,25 @@ jobs:
           file: ./docker/Dockerfile
           push: true
           tags: |
-            ghcr.io/${{ steps.repo.outputs.repo }}:nightly-${{ steps.date.outputs.date }}
+            ghcr.io/${{ steps.repo.outputs.repo }}:${{ needs.generate-version.outputs.tag }}
+            ghcr.io/${{ steps.repo.outputs.repo }}:${{ needs.generate-version.outputs.version }}
             ghcr.io/${{ steps.repo.outputs.repo }}:nightly
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64,linux/riscv64
 
   release:
     name: Release
     runs-on: ubuntu-latest
     needs: [generate-version, build]
+    permissions:
+      contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: picoclaw-binaries
           path: ./build