diff --git a/.github/workflows/migrations.yml b/.github/workflows/migrations.yml
index 9c37098f6..5adb3bc7a 100644
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrations.yml
@@ -10,6 +10,9 @@ permissions: read-all
 jobs:
   migrate-postgres:
     runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
     services:
       postgres:
         image: postgres:15
@@ -24,7 +27,6 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -47,11 +49,15 @@ jobs:
           DB_USER: user
           DB_PASSWD: password
           DB_NAME: testdb
-          ROMM_AUTH_SECRET_KEY: xxxxxxxxxxxxxxxxx
+          ROMM_AUTH_SECRET_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+          ROMM_BASE_PATH: romm_test
         run: uv run alembic upgrade head
 
   migrate-mariadb:
     runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
     services:
       mariadb:
         image: mariadb:10.11
@@ -67,10 +73,9 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
-
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4.3.0
 
       - name: Install mariadb connectors
         run: |
@@ -95,5 +100,6 @@ jobs:
           DB_USER: user
           DB_PASSWD: password
           DB_NAME: testdb
-          ROMM_AUTH_SECRET_KEY: xxxxxxxxxxxxxxxxx
+          ROMM_AUTH_SECRET_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+          ROMM_BASE_PATH: romm_test
         run: uv run alembic upgrade head
diff --git a/backend/pytest.ini b/backend/pytest.ini
index 73b8bc455..98b3089fb 100644
--- a/backend/pytest.ini
+++ b/backend/pytest.ini
@@ -16,7 +16,7 @@ env =
    SCREENSCRAPER_PASSWORD=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    STEAMGRIDDB_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    LAUNCHBOX_API_ENABLED=true
-   ROMM_AUTH_SECRET_KEY=843f6cefc5ba1430d54061301c2893be00c2aef11dae39ffec13a2af1a86e867
+   ROMM_AUTH_SECRET_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
    ENABLE_SCHEDULED_RESCAN=true
    ENABLE_SCHEDULED_UPDATE_SWITCH_TITLEDB=true