diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index a60583c96..07c368d93 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -1,23 +1,31 @@
 name: Basic Setup
 description: Install PNPM, Node, and dependencies
+
 inputs:
   install:
     default: 'true'
+    type: boolean
     description: Whether or not to run 'pnpm install'
+
   installArgs:
     default: ''
+    type: string
     description: Additional args to append to "pnpm install"
+
 runs:
   using: composite
+
   steps:
-    - name: Setup PNPM
+    - name: 🛠️ Setup PNPM
       uses: pnpm/action-setup@v4
-    - name: Setup NodeJS
+
+    - name: 🛠️ Setup NodeJS
       uses: actions/setup-node@v4
       with:
         node-version: 18
         cache: pnpm
-    - name: Install Dependencies
+
+    - name: 📦 Install Dependencies
       if: ${{ inputs.install == 'true' }}
       shell: bash
       run: pnpm install ${{ inputs.installArgs }}
diff --git a/.github/workflows/pkg.pr.new.yml b/.github/workflows/pkg.pr.new.yml
index b86c1edab..fd35a94c7 100644
--- a/.github/workflows/pkg.pr.new.yml
+++ b/.github/workflows/pkg.pr.new.yml
@@ -1,4 +1,4 @@
-name: Continuous Publish
+name: 🚀 Continuous Publish
 on:
   push:
     branches:
@@ -7,11 +7,22 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    name: Build
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm buildc all
-      - run: pnpx pkg-pr-new publish --compact './packages/*'
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Build All Packages
+        run: pnpm buildc all
+
+      - name: Publish
+        run: pnpx pkg-pr-new publish --compact './packages/*'
diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index e80893d5f..f461a3d68 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -1,4 +1,4 @@
-name: Publish Docs
+name: 📝 Publish Docs
 on:
   push:
     branches:
@@ -10,20 +10,38 @@ on:
         required: true
         default: latest
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     # Only run if it's the upstream repository, not forks
     if: github.repository == 'wxt-dev/wxt'
+    name: Publish Docs
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - uses: docker/login-action@v3
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
         with:
           registry: https://${{ secrets.DOCKER_REGISTRY_HOSTNAME }}
           username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
           password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
-      - run: pnpm docs:build
-      - run: docker build docs/.vitepress -t ${{ secrets.DOCKER_REGISTRY_HOSTNAME }}/wxt/docs:${{ github.event.inputs.tag || 'latest' }}
-      - run: docker push ${{ secrets.DOCKER_REGISTRY_HOSTNAME }}/wxt/docs:${{ github.event.inputs.tag || 'latest' }}
-      - run: curl -X POST -i ${{ secrets.UPDATE_DOCS_WEBHOOK }}
+
+      - name: Build docs
+        run: |
+          pnpm docs:build
+          docker build docs/.vitepress -t ${{ secrets.DOCKER_REGISTRY_HOSTNAME }}/wxt/docs:${{ github.event.inputs.tag || 'latest' }}
+
+      - name: Push Image
+        run: docker push ${{ secrets.DOCKER_REGISTRY_HOSTNAME }}/wxt/docs:${{ github.event.inputs.tag || 'latest' }}
+
+      - name: Deploy
+        run: curl -X POST -i ${{ secrets.UPDATE_DOCS_WEBHOOK }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 76e21651d..653b081e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: Release
+name: 🚀 Release
 on:
   workflow_dispatch:
     inputs:
@@ -17,38 +17,51 @@ on:
           - unocss
           - wxt
 
+permissions:
+  contents: read
+
 jobs:
   validate:
+    name: Validate
     uses: './.github/workflows/validate.yml'
     secrets: inherit
 
   publish:
+    name: Publish
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     needs:
       - validate
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: ./.github/actions/setup
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Configure Git
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          git config --global push.followTags true
 
       - name: Bump and Tag
         run: |
-          git config user.email "github-actions@users.noreply.github.com"
-          git config user.name "GitHub Actions"
           pnpm tsx scripts/bump-package-version.ts ${{ inputs.package }}
           git push
           git push --tags
 
-      - name: NPM
+      - name: Publish to NPM
+        working-directory: packages/${{ inputs.package }}
         run: |
           echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_AUTH_TOKEN }}" > ~/.npmrc
           pnpm build
           pnpm publish
-        working-directory: packages/${{ inputs.package }}
 
-      - name: GitHub Release
+      - name: Create GitHub release
         run: pnpm tsx scripts/create-github-release.ts ${{ inputs.package }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sync-releases.yml b/.github/workflows/sync-releases.yml
index 35f18d26d..78426417c 100644
--- a/.github/workflows/sync-releases.yml
+++ b/.github/workflows/sync-releases.yml
@@ -1,4 +1,4 @@
-name: Sync Releases
+name: 🔄 Sync Releases
 on:
   workflow_dispatch:
     inputs:
@@ -16,14 +16,25 @@ on:
           - storage
           - wxt
 
+permissions:
+  contents: read
+
 jobs:
   sync:
+    name: Sync Releases
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
           installArgs: --ignore-scripts
-      - run: pnpm tsx scripts/sync-releases.ts ${{ inputs.package }}
+
+      - name: Sync Releases
+        run: pnpm tsx scripts/sync-releases.ts ${{ inputs.package }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 0a9e9db55..636f0f40c 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -1,4 +1,4 @@
-name: Validate
+name: ✅ Validate
 on:
   workflow_call:
   pull_request:
@@ -6,46 +6,90 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   checks:
+    name: Checks
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm check
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Type Check
+        run: pnpm check
+
   builds:
+    name: Builds
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm buildc all
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Build All Packages
+        run: pnpm buildc all
+
   build-demo:
+    name: Build Demo
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm build:all
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Build
+        run: pnpm build:all
         working-directory: packages/wxt-demo
-      - run: pnpm wxt zip
+
+      - name: ZIP
+        run: pnpm wxt zip
         working-directory: packages/wxt-demo
+
   tests:
+    name: Tests
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - uses: oven-sh/setup-bun@v2
-      - name: pnpm test:coverage
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Run Tests
         run: pnpm test:coverage -- --reporter=default --reporter=hanging-process
-      - uses: codecov/codecov-action@v5
+
+      - name: Upload Coverage
+        uses: codecov/codecov-action@v5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
   windows-tests:
+    name: Windows Tests
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm test
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Run Tests
+        run: pnpm test
+
   template:
+    name: Template
     runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
@@ -57,19 +101,34 @@ jobs:
           - vanilla
           - vue
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
-      - run: pnpm pack
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Pack WXT package
+        run: pnpm pack
         working-directory: packages/wxt
-      - run: npm i
+
+      - name: Install Dependencies
+        run: npm i
         working-directory: templates/${{ matrix.template }}
-      - run: npm i -D ../../packages/wxt/wxt-*.tgz
+
+      - name: Install Packed WXT
+        run: npm i -D ../../packages/wxt/wxt-*.tgz
         working-directory: templates/${{ matrix.template }}
-      - run: pnpm compile
+
+      - name: Type Check Template
+        run: pnpm compile
         if: matrix.template != 'svelte'
         working-directory: templates/${{ matrix.template }}
-      - run: pnpm check
+
+      - name: Type Check Template
+        run: pnpm check
         if: matrix.template == 'svelte'
         working-directory: templates/${{ matrix.template }}
-      - run: pnpm build
+
+      - name: Build Template
+        run: pnpm build
         working-directory: templates/${{ matrix.template }}
diff --git a/.github/workflows/vhs.yml b/.github/workflows/vhs.yml
index 1d822165b..b6cdc10f9 100644
--- a/.github/workflows/vhs.yml
+++ b/.github/workflows/vhs.yml
@@ -1,26 +1,41 @@
-name: vhs
+name: 📼 VHS
 on:
   push:
     paths:
       - 'docs/tapes/*.tape'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   vhs:
+    name: Create VHS
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup
+        uses: ./.github/actions/setup
         with:
-          install: 'false'
-      - name: Preinstall WXT
+          install: false
+
+      # This prevents pnpm dlx from downloading WXT in the video
+      - name: Pre-install WXT
         run: |
           pnpm store add wxt@latest
           pnpm dlx wxt@latest --version
-      - uses: charmbracelet/vhs-action@v2.1.0
+
+      - name: Record VHS
+        uses: charmbracelet/vhs-action@v2.1.0
         with:
           path: 'docs/tapes/init-demo.tape'
-      - uses: stefanzweifel/git-auto-commit-action@v5
+
+      - name: Save recorded GIF
+        uses: stefanzweifel/git-auto-commit-action@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: