diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
index d00e4e9..f89f31c 100644
--- a/.github/workflows/action.yml
+++ b/.github/workflows/action.yml
@@ -1,6 +1,9 @@
 ---
 name: action
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -41,8 +44,6 @@ jobs:
     name: Expected local npm actions
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -56,8 +57,6 @@ jobs:
     name: Action
     runs-on: ubuntu-latest
     if: github.ref != 'refs/heads/main'
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: raven-actions/actionlint@v2
@@ -94,8 +93,6 @@ jobs:
   unit_tests_macos:
     name: Unit tests (macOS)
     runs-on: macos-latest
-    permissions:
-      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
diff --git a/.github/workflows/hexpm-mirrors.yml b/.github/workflows/hexpm-mirrors.yml
index 211a5c7..da65c0d 100644
--- a/.github/workflows/hexpm-mirrors.yml
+++ b/.github/workflows/hexpm-mirrors.yml
@@ -1,6 +1,9 @@
 ---
 name: hexpm-mirrors
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index b2d0477..44823a0 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -1,5 +1,6 @@
 ---
 name: macos
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 950da5e..a01d72e 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -1,6 +1,9 @@
 ---
 name: ubuntu
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/update_3rd_party_licenses.yml b/.github/workflows/update_3rd_party_licenses.yml
index 318fa19..627df10 100644
--- a/.github/workflows/update_3rd_party_licenses.yml
+++ b/.github/workflows/update_3rd_party_licenses.yml
@@ -1,6 +1,9 @@
 ---
 name: Update 3rd party licenses (automation)
 
+permissions:
+  contents: write
+
 on:
   schedule:
     - cron: '0 12 * * *'
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index d7a4dca..ebfcbd8 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,6 +1,9 @@
 ---
 name: windows
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/dist/index.js b/dist/index.js
index 297f37b..b6c341c 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -26068,10 +26068,11 @@ function requestedVersionFor(tool, version, originListing, mirrors) {
 }
 
 async function getElixirVersion(exSpec0, otpVersion0) {
-  const otpVersion = otpVersion0.match(/^([^-]+-)?(.+)$/)[2]
+  const otpVersion = otpVersion0.match(/^(?:OTP-)?(.+)$/)[1]
   let otpVersionMajor = otpVersion.match(/^([^.]+).*$/)[1]
 
-  const userSuppliedOtp = exSpec0.match(/-otp-(\d+)/)?.[1] ?? null
+  const otpSuffix = /-otp-(\d+)/
+  const userSuppliedOtp = exSpec0.match(otpSuffix)?.[1] ?? null
 
   if (userSuppliedOtp && isVersion(userSuppliedOtp)) {
     otpVersionMajor = userSuppliedOtp
@@ -26079,7 +26080,7 @@ async function getElixirVersion(exSpec0, otpVersion0) {
 
   const [otpVersionsForElixirMap, elixirVersions, originListing, hexMirrors] =
     await getElixirVersions()
-  const spec = exSpec0.replace(/-otp-.*$/, '')
+  const spec = exSpec0.replace(otpSuffix, '')
   const versions = elixirVersions
   const elixirVersionFromSpec = getVersionFromSpec(spec, versions)
 
diff --git a/src/setup-beam.js b/src/setup-beam.js
index 7be1178..87319fb 100644
--- a/src/setup-beam.js
+++ b/src/setup-beam.js
@@ -193,10 +193,11 @@ function requestedVersionFor(tool, version, originListing, mirrors) {
 }
 
 async function getElixirVersion(exSpec0, otpVersion0) {
-  const otpVersion = otpVersion0.match(/^([^-]+-)?(.+)$/)[2]
+  const otpVersion = otpVersion0.match(/^(?:OTP-)?(.+)$/)[1]
   let otpVersionMajor = otpVersion.match(/^([^.]+).*$/)[1]
 
-  const userSuppliedOtp = exSpec0.match(/-otp-(\d+)/)?.[1] ?? null
+  const otpSuffix = /-otp-(\d+)/
+  const userSuppliedOtp = exSpec0.match(otpSuffix)?.[1] ?? null
 
   if (userSuppliedOtp && isVersion(userSuppliedOtp)) {
     otpVersionMajor = userSuppliedOtp
@@ -204,7 +205,7 @@ async function getElixirVersion(exSpec0, otpVersion0) {
 
   const [otpVersionsForElixirMap, elixirVersions, originListing, hexMirrors] =
     await getElixirVersions()
-  const spec = exSpec0.replace(/-otp-.*$/, '')
+  const spec = exSpec0.replace(otpSuffix, '')
   const versions = elixirVersions
   const elixirVersionFromSpec = getVersionFromSpec(spec, versions)