diff --git a/internal/ci/base/github.cue b/internal/ci/base/github.cue
index 289a9123c..75a8d1ffc 100644
--- a/internal/ci/base/github.cue
+++ b/internal/ci/base/github.cue
@@ -1,3 +1,5 @@
+@experiment(explicitopen)
+
 package base
 
 // This file contains aspects principally related to GitHub workflows
@@ -12,11 +14,30 @@ import (
 )
 
 bashWorkflow: githubactions.#Workflow & {
-	// Use a custom default shell that extends the GitHub default to also fail
-	// on access to unset variables.
-	//
-	// https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell
-	jobs: [string]: defaults: run: shell: "bash --noprofile --norc -euo pipefail {0}"
+
+	jobs: [string]: {
+		// Use a custom default shell that extends the GitHub default to also fail
+		// on access to unset variables.
+		//
+		// https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell
+		defaults: run: shell: "bash --noprofile --norc -euo pipefail {0}"
+
+		// We want to allow steps in a job to define constraints on the job that
+		// contains them. To allow this for steps that are re-used between jobs,
+		// we need a means of a step declaring constraints that should be applied
+		// on the outer structure. And then use a comprehension at the job level
+		// to "lift" the constraints from the steps it contains.
+		//
+		// TODO: for some reason, as a result of either cuelang.org/issue/3594 or
+		// cuelang.org/issue/4079 we can't constrain this field as follows:
+		//
+		// steps: [...{#job: githubactions.#Job}]
+		steps: [...{#job: _}]
+
+		for _, s in steps {
+			s.#job...
+		}
+	}
 }
 
 // These are useful for workflows where we use a matrix over different OS runners
@@ -344,6 +365,7 @@ _dispatchTrailerVariable: "github.event.head_commit.message"
 // TODO: enforce that the job to which this belongs has the relevant
 // permission.
 loginCentralRegistry: githubactions.#Step & {
+	#job: permissions: "id-token": "write"
 	name: "Login to CUE registry"
 	uses: "cue-labs/registry-login-action@v1"
 }
diff --git a/internal/ci/cue.mod/module.cue b/internal/ci/cue.mod/module.cue
index 8b5b306dc..b4d1dcce9 100644
--- a/internal/ci/cue.mod/module.cue
+++ b/internal/ci/cue.mod/module.cue
@@ -1,6 +1,6 @@
 module: "github.com/cue-lang/tmp/internal/ci"
 language: {
-	version: "v0.13.0"
+	version: "v0.15.0"
 }
 source: {
 	kind: "self"
diff --git a/internal/ci/github/release.cue b/internal/ci/github/release.cue
index 683f10b2b..12a4c1e4b 100644
--- a/internal/ci/github/release.cue
+++ b/internal/ci/github/release.cue
@@ -38,7 +38,6 @@ workflows: release: _repo.bashWorkflow & {
 		branches: list.Concat([[_repo.testDefaultBranch], _repo.protectedBranchPatterns])
 	}
 	jobs: goreleaser: {
-		permissions: "id-token": "write"
 		"runs-on": _repo.linuxMachine
 		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
 
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index 9061afd7e..28e175f07 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -35,7 +35,6 @@ workflows: trybot: _repo.bashWorkflow & {
 
 	jobs: {
 		test: {
-			permissions: "id-token": "write"
 			strategy: {
 				"fail-fast": false
 				matrix: {