diff --git a/.claude/settings.json b/.claude/settings.json
index 47a56e14ef6..77967fc4346 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -86,7 +86,8 @@
     ],
     "deny": [
       "Read(.env.local)",
-      "Read(credentials/)"
+      "Read(credentials/)",
+      "Read(credentials/**)"
     ]
   },
   "hooks": {
diff --git a/.github/workflows/jira-agent-pipeline.yml b/.github/workflows/jira-agent-pipeline.yml
index df2c6a679d4..a84258a9fc0 100644
--- a/.github/workflows/jira-agent-pipeline.yml
+++ b/.github/workflows/jira-agent-pipeline.yml
@@ -186,6 +186,9 @@ jobs:
         permissions:
             contents: read
             packages: read
+            pull-requests: read
+            checks: read
+            statuses: read
         steps:
             - uses: actions/checkout@v4
               with:
diff --git a/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs b/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
index 7829e07944e..4a5f4c05633 100644
--- a/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
+++ b/external/ag-shared/scripts/ossf-scorecard/getAndCheckResults.mjs
@@ -6,8 +6,8 @@ export async function getOSSFScorecardResults({ project, threshold }) {
         process.exit(1);
     }
 
-    const scorecardJsonUrl = `https://api.securityscorecards.dev/projects/github.com/ag-grid/ag-${project}`;
-    const response = await fetch(scorecardJsonUrl);
+    const scorecardJsonUrl = `https://api.scorecard.dev/projects/github.com/ag-grid/ag-${project}`;
+    const response = await fetch(`${scorecardJsonUrl}?cachebust=${Date.now()}`);
     const results = await response.json();
 
     const score = results.score;
@@ -37,7 +37,7 @@ export async function getOSSFScorecardResults({ project, threshold }) {
             tests: [
                 {
                     name: `OpenSSF Score >= ${threshold}`,
-                    message: `Score = ${score}, from ${scorecardJsonUrl}. See ${resultsUrl} for full details.`,
+                    message: `Score = ${score}, scanned ${results.date}, from ${scorecardJsonUrl}. See ${resultsUrl} for full details.`,
                     status,
                     duration: 0,
                 },