diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
index 0f42bfd472..ba37bd2697 100644
--- a/.github/workflows/build_provider.yml
+++ b/.github/workflows/build_provider.yml
@@ -38,6 +38,8 @@ jobs:
           dotnet: false
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:
diff --git a/.github/workflows/build_sdk.yml b/.github/workflows/build_sdk.yml
index 002d035972..7f694ef8ea 100644
--- a/.github/workflows/build_sdk.yml
+++ b/.github/workflows/build_sdk.yml
@@ -49,6 +49,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Cache examples generation
         uses: actions/cache@v4
         with:
diff --git a/.github/workflows/check-upstream-upgrade.yml b/.github/workflows/check-upstream-upgrade.yml
deleted file mode 100644
index a4d997bc0c..0000000000
--- a/.github/workflows/check-upstream-upgrade.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-
-#WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
-
-env:
-  GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
-jobs:
-  check_upgrade_provider:
-    name: Check for upstream provider upgrades
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: go
-    - name: Install upgrade-provider
-      run: go install github.com/pulumi/upgrade-provider@main
-      shell: bash
-    - name: "Set up git identity: name"
-      run: git config --global user.name pulumi-bot
-      shell: bash
-    - name: "Set up git identity: email"
-      run: git config --global user.email bot@pulumi.com
-      shell: bash
-    - name: Run upgrade-provider upstream check
-      id: upstream_version
-      run: |
-        upgrade-provider "$REPO" --kind=check-upstream-version
-      env:
-        REPO: ${{ github.repository }}
-      shell: bash
-name: Check upstream upgrade
-on:
-  workflow_dispatch: {} #so we can run this manually if necessary.
-  schedule:
-    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
-    - cron: 0 3 * * *
diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml
index 52879d249d..91ebc36635 100644
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -31,6 +31,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: peter-evans/slash-command-dispatch@v4
       with:
         commands: |
diff --git a/.github/workflows/community-moderation.yml b/.github/workflows/community-moderation.yml
index 4c3414b904..2afb297c25 100644
--- a/.github/workflows/community-moderation.yml
+++ b/.github/workflows/community-moderation.yml
@@ -9,6 +9,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - id: schema_changed
       name: Check for diff in schema
       uses: dorny/paths-filter@v2
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 3fe80ebe98..45d1bfcf03 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -38,6 +38,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0e0a266c81..deeedd7007 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -38,6 +38,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Install go
       uses: actions/setup-go@v5
       with:
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index d6c9e6da7f..23eb080dcf 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -63,6 +63,8 @@ jobs:
         swap-storage: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -150,6 +152,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
diff --git a/.github/workflows/nightly-test.yml b/.github/workflows/nightly-test.yml
index 0b10214fb2..25b823ed0f 100644
--- a/.github/workflows/nightly-test.yml
+++ b/.github/workflows/nightly-test.yml
@@ -69,6 +69,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 635b404647..cae93c0ec0 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -94,6 +94,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
index b0b62976c5..adb1a84872 100644
--- a/.github/workflows/prerequisites.yml
+++ b/.github/workflows/prerequisites.yml
@@ -58,6 +58,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: pulumi/provider-version-action@v1
       id: provider-version
       with:
@@ -90,7 +92,7 @@ jobs:
         EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
         {
           echo "SCHEMA_CHANGES<<$EOF";
-          schema-tools compare -r github://api.github.com/pulumi -p azure -o ${{ inputs.default_branch }} -n --local-path=provider/cmd/pulumi-resource-azure/schema.json;
+          schema-tools compare -r github://api.github.com/pulumi -p azure -o "${{ inputs.default_branch }}" -n --local-path=provider/cmd/pulumi-resource-azure/schema.json;
           echo "$EOF";
         } >> "$GITHUB_ENV"
     - if: inputs.is_pr && inputs.is_automated == false
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 31cb8beb72..050a4105f0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -54,6 +54,8 @@ jobs:
       run: echo "Can't skip Go SDK for stable releases. This is likely a bug in the calling workflow." && exit 1
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
@@ -79,7 +81,7 @@ jobs:
         merge-multiple: true
     - name: Calculate checksums
       working-directory: dist
-      run: shasum ./*.tar.gz > pulumi-azure_${{ inputs.version }}_checksums.txt
+      run: shasum ./*.tar.gz > "pulumi-azure_${{ inputs.version }}_checksums.txt"
     - name: Get Schema Change Summary
       id: schema-summary
       shell: bash
@@ -116,6 +118,9 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push back to the repo
+        persist-credentials: true
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
@@ -173,6 +178,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Clean up release labels
       uses: pulumi/action-release-by-pr-label@main
       with:
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 7e6c2ea164..c9c9cd7ed6 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -32,6 +32,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Comment PR
       uses: thollander/actions-comment-pull-request@v2
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4049911063..829d5ac2a0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -100,6 +100,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
diff --git a/.github/workflows/release_command.yml b/.github/workflows/release_command.yml
index 2a8fff366c..4029f32a79 100644
--- a/.github/workflows/release_command.yml
+++ b/.github/workflows/release_command.yml
@@ -12,6 +12,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Should release PR
       uses: pulumi/action-release-by-pr-label@main
       with:
diff --git a/.github/workflows/resync-build.yml b/.github/workflows/resync-build.yml
index b8b1cc2071..41c23f3aa2 100644
--- a/.github/workflows/resync-build.yml
+++ b/.github/workflows/resync-build.yml
@@ -33,11 +33,15 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push a new branch.
+        persist-credentials: true
     - name: Checkout repo
       uses: actions/checkout@v4
       with:
         path: ci-mgmt
         repository: pulumi/ci-mgmt
+        persist-credentials: false
     - id: run-url
       name: Create URL to the run output
       run:  echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
index 4bf8657bca..be625ed1d7 100644
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -144,6 +144,7 @@ jobs:
       uses: actions/checkout@v4
       with:
         ref: ${{ env.PR_COMMIT_SHA }}
+        persist-credentials: false
     - name: Checkout p/examples
       if: matrix.testTarget == 'pulumiExamples'
       uses: actions/checkout@v4
diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml
index b096d4a112..985638c6b2 100644
--- a/.github/workflows/upgrade-bridge.yml
+++ b/.github/workflows/upgrade-bridge.yml
@@ -66,6 +66,8 @@ jobs:
         dotnet: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml
index 0470957423..2e849dc24c 100644
--- a/.github/workflows/upgrade-provider.yml
+++ b/.github/workflows/upgrade-provider.yml
@@ -1,11 +1,25 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade provider
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: |
+          The version of the upstream provider to upgrade to, without the 'v' prefix
+          
+          If no version is specified, it will be inferred from the upstream provider's release tags.
+        required: false
+        type: string
+  schedule:
+    # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours.
+    - cron: 0 3 * * *
+
 env:
   GH_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 jobs:
   upgrade_provider:
-    if: ${{ (github.event.issue.user.login == 'pulumi-bot' && contains(github.event.issue.title, 'Upgrade terraform-provider-')) || github.event_name == 'workflow_dispatch' }}
     name: upgrade-provider
     runs-on: ubuntu-latest
     steps:
@@ -18,6 +32,9 @@ jobs:
           dotnet: false
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          # Persist credentials so upgrade-provider can push a new branch.
+          persist-credentials: true
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:
@@ -25,17 +42,27 @@ jobs:
       - name: Install upgrade-provider
         run: go install github.com/pulumi/upgrade-provider@main
         shell: bash
-      - name: "Set up git identity: name"
+      - name: "Set up git identity"
         run: |
           git config --global user.name 'bot@pulumi.com'
           git config --global user.email 'bot@pulumi.com'
         shell: bash
-      - name: Run upgrade-provider
-        run: upgrade-provider "${{ github.repository }}" --kind="all" 
+      - name: Create issues for new upstream version
+        if: inputs.version == ''
+        id: upstream_version
+        # This step outputs `latest_version` if there is a pending upgrade
+        run: upgrade-provider "$REPO" --kind=check-upstream-version
+        env:
+          REPO: ${{ github.repository }}
+        shell: bash
+      - name: Calculate target version
+        id: target_version
+        # Prefer the manually specified version if it exists
+        # upstream_version will be empty if the provider is up-to-date
+        run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
+        shell: bash
+      - name: Attempt provider upgrade
+        # Only attempt the upgrade if we have a target version
+        if: steps.target_version.outputs.version != ''
+        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
         shell: bash
-name: Upgrade provider
-on:
-  issues:
-    types:
-      - opened
-  workflow_dispatch: {}
diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
index 4d7849be65..1d1d1389de 100644
--- a/.github/workflows/verify-release.yml
+++ b/.github/workflows/verify-release.yml
@@ -72,6 +72,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with: