diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c9cbd6e..e9d9c746 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,11 +47,7 @@ jobs:
   tidy:
     uses: taiki-e/github-actions/.github/workflows/tidy.yml@931686d4e4cf88b13e790040727ccde2dba8ec62 # main
     permissions:
-      contents: write # for creating branch for pr
-      pull-requests: write # unused (used in `codegen-automerge: true` case)
       security-events: write # for github/codeql-action/*
-    secrets:
-      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
 
   test:
     strategy:
@@ -257,8 +253,7 @@ jobs:
       - name: Install requirements (old debian)
         run: |
           # In Debian, the old repositories is removed from the main mirrors some time after EoL.
-          # shellcheck source=/dev/null
-          codename=$(. /etc/os-release; printf '%s\n' "${VERSION_CODENAME}")
+          codename=$(grep -E '^VERSION_CODENAME=' /etc/os-release | cut -d= -f2)
           sed -i /etc/apt/sources.list -e 's/deb.debian.org/archive.debian.org/g' \
             -e 's|security.debian.org|archive.debian.org/|g' \
             -e "/${codename}-updates/d"