diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 98db0b547..4c664413e 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -14,6 +14,13 @@ on:
 
 jobs:
   deploy:
+    # Permission CEILING for the called workflow, not a grant: the callee's
+    # deploy job declares `contents: write` (gh-pages push) and its fallback
+    # image job `packages: write` (GHCR). A ceiling below what the callee
+    # declares makes the call fail to start.
+    permissions:
+      contents: write
+      packages: write
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
     # A reusable workflow receives NO secrets by default. Without this block the
     # callee's publish step finds CF_API_TOKEN empty, skips itself on its own
diff --git a/docs/features.json b/docs/features.json
index d880a6028..8f72e5197 100644
--- a/docs/features.json
+++ b/docs/features.json
@@ -150,7 +150,7 @@
     "slug": "license-and-seat-tracking",
     "title": "License and seat tracking",
     "summary": "Track license models and seats next to your contracts.",
-    "status": "soon",
+    "status": "stable",
     "docsUrl": "openspec/specs/license-and-seat-tracking/spec.md",
     "title_nl": "Licentie- en seatregistratie",
     "summary_nl": "Houd licentiemodellen en seats bij naast je contracten."
diff --git a/tests/e2e/workflows/_fixtures.ts b/tests/e2e/workflows/_fixtures.ts
index ed688de99..d91fa5aff 100644
--- a/tests/e2e/workflows/_fixtures.ts
+++ b/tests/e2e/workflows/_fixtures.ts
@@ -26,6 +26,7 @@
 import type { APIRequestContext } from '@playwright/test'
 
 import { request as playwrightRequest } from '@playwright/test'
+import { randomUUID } from 'node:crypto'
 import { resolveBaseUrl } from '../base-url.ts'
 
 // Re-exported from the single central resolver (tests/e2e/base-url.ts). These
@@ -36,7 +37,7 @@ export const NC_ADMIN_USER = process.env.NC_ADMIN_USER ?? 'admin'
 export const NC_ADMIN_PASS = process.env.NC_ADMIN_PASS ?? 'admin'
 
 /** Unique per Node process so parallel-ish runs never collide. */
-export const RUN_ID = `e2e-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
+export const RUN_ID = `e2e-${Date.now().toString(36)}-${randomUUID().slice(0, 4)}`
 
 export interface VoorzieningenConfig {
 	register: string