diff --git a/.github/workflows/build-test-gc.yml b/.github/workflows/build-test-gc.yml
index 30e6ff4..05deb7a 100644
--- a/.github/workflows/build-test-gc.yml
+++ b/.github/workflows/build-test-gc.yml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: [ "master", "Release*" ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index d26ddf2..419803f 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -2,7 +2,7 @@
 # Triggered whenever a PR into the main or a Release* branch is opened
 # Triggered for each new published release
 
-name: Build and test (wo graphcut)
+name: Linux build and test (wo graphcut)
 
 on:
   release:
@@ -10,6 +10,9 @@ on:
   pull_request:
     branches: [ "master", "Release*" ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/macos-build-test.yml b/.github/workflows/macos-build-test.yml
new file mode 100644
index 0000000..273e237
--- /dev/null
+++ b/.github/workflows/macos-build-test.yml
@@ -0,0 +1,39 @@
+# MacOS: Build the package and run all tests except the graph-cut ones
+# Triggered whenever a PR into the main or a Release* branch is opened
+# Triggered for each new published release
+
+name: MacOS build and test (wo graphcut)
+
+on:
+  release:
+      types: [published]
+  pull_request:
+    branches: [ "master", "Release*" ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.8", "3.9", "3.10", "3.11"]
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Install with test dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install .[test]
+    - name: Test with pytest
+      run: |
+        pytest tests/features_/*
+        pytest tests/filter_/*
+        pytest tests/io_/*
+        pytest tests/metric_/*
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 4648d77..8c45e0c 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [ "master", "Release*" ]
 
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
diff --git a/RELEASE.md b/RELEASE.md
index 8fedd27..bbb76e4 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -13,6 +13,7 @@
 - Update `CHANGES.txt`, highlighting only major changes
 
 ## Release
-- Build package and upload to pypi
+- Build package (e.g. with `python -m build`)
+- Upload to PyPI
 - Update conda-force recipe to new version (PR)
 - Update DOI