diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 34d823458..e6eaa35f1 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -25,6 +25,8 @@ updates:
     labels:
       - "area/dependencies"
       - "area/docker"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "github-actions"
     # The "github-actions" code explicitly looks in /.github/workflows if the
@@ -35,6 +37,8 @@ updates:
     labels:
       - "area/dependencies"
       - "area/devops"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     # OpenFermion has requirements.txt files in multiple places.
@@ -46,3 +50,5 @@ updates:
     versioning-strategy: "increase-if-necessary"
     labels:
       - "area/dependencies"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9de1a40bd..3de12e84d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -56,7 +56,9 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
-permissions: read-all
+# Declare default permissions as read only.
+permissions:
+  contents: read
 
 jobs:
   python-checks:
@@ -68,6 +70,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -112,6 +115,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -144,6 +149,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -173,6 +180,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
         # Note: deliberately not using our Python cache here b/c this runs
         # a different version of Python.
@@ -202,6 +211,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -228,6 +238,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install yamllint
         run: |
@@ -248,6 +260,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run hadolint on Dockerfiles
         env:
@@ -258,7 +272,7 @@ jobs:
           files=(**/[Dd]ockerfile*)
           if [[ ${#files[@]} -gt 0 ]]; then
             docker run --rm -v "${PWD}:/app" -w /app \
-            ghcr.io/hadolint/hadolint@${{env.sha}} /bin/hadolint "${files[@]}"
+            "ghcr.io/hadolint/hadolint@${sha}" /bin/hadolint "${files[@]}"
           fi
 
   workflow-lint:
@@ -268,6 +282,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run actionlint
         uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
@@ -283,6 +299,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run shellcheck on shell scripts
         run: |
@@ -296,6 +314,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/nightly-pytest.yaml b/.github/workflows/nightly-pytest.yaml
index 70ff14233..b73b2a9df 100644
--- a/.github/workflows/nightly-pytest.yaml
+++ b/.github/workflows/nightly-pytest.yaml
@@ -35,8 +35,13 @@ on:
   # Allow manual invocation.
   workflow_dispatch:
 
+concurrency:
+  cancel-in-progress: true
+  group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
+
 # Declare default workflow permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   Pytest:
@@ -75,6 +80,8 @@ jobs:
     steps:
       - name: Check out a copy of the OpenFermion git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{matrix.python-version}}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -89,7 +96,11 @@ jobs:
         run: pip install -r dev_tools/requirements/envs/pytest.env.txt
 
       - name: Install cirq-core (current stable version)
-        run: pip install -U cirq-core ${{inputs.args}}
+        env:
+          INSTALL_ARGS: ${{inputs.args}}
+        run: |
+          # shellcheck disable=SC2086
+          pip install -U cirq-core $INSTALL_ARGS
 
       - name: Set up Pytest output problem matcher
         run: echo '::add-matcher::.github/problem-matchers/pytest.json'
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 1c267204b..e45505da8 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -29,7 +29,8 @@ on:
   workflow_dispatch:
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   cirq-stable:
diff --git a/.github/workflows/scorecard-scanner.yaml b/.github/workflows/scorecard-scanner.yaml
index d002919d7..a9d907039 100644
--- a/.github/workflows/scorecard-scanner.yaml
+++ b/.github/workflows/scorecard-scanner.yaml
@@ -39,7 +39,8 @@ concurrency:
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
 # Declare default workflow permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   run-scorecard:
@@ -47,12 +48,12 @@ jobs:
     if: >-
       github.repository_owner == 'quantumlib' &&
       (github.event_name != 'pull_request' ||
-       github.event.pull_request.head.repo.fork == false)
+       github.event.pull_request.head.repo.full_name == github.repository)
     name: Scorecard analyzer
     runs-on: ubuntu-24.04
     permissions:
-      security-events: write
-      id-token: write
+      security-events: write # Needed to upload SARIF results to GitHub Code Scanning dashboard.
+      id-token: write # Needed to sign and publish Scorecard results.
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
@@ -83,10 +84,11 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Write the Scorecard report page link to the workflow summary
+        env:
+          REPO: ${{github.repository}}
         run: |
-          repo="${{github.repository}}"
-          url="https://scorecard.dev/viewer/?uri=github.com/${repo}"
+          url="https://scorecard.dev/viewer/?uri=github.com/${REPO}"
           {
           echo -n "The results are available on the OpenSSF Scorecard "
-          echo "[report page for ${{github.repository}}]($url)."
+          echo "[report page for ${REPO}]($url)."
           } >> "$GITHUB_STEP_SUMMARY"
diff --git a/docs/fqe/tutorials/fermi_hubbard.ipynb b/docs/fqe/tutorials/fermi_hubbard.ipynb
index 32f33ee87..bc33bf8b4 100644
--- a/docs/fqe/tutorials/fermi_hubbard.ipynb
+++ b/docs/fqe/tutorials/fermi_hubbard.ipynb
@@ -173,6 +173,7 @@
    },
    "outputs": [],
    "source": [
+    "np.random.seed(0)\n",
     "nele, sz = 2, 0\n",
     "init_wfn = fqe.Wavefunction([[nele, sz, nsites]])\n",
     "init_wfn.set_wfn(strategy=\"random\")"
@@ -196,7 +197,7 @@
    "outputs": [],
    "source": [
     "%%time\n",
-    "e_time = 0.9\n",
+    "e_time = 0.1\n",
     "true_evolved_fqe = init_wfn.time_evolve(e_time, hubbard)"
    ]
   },