diff --git a/.github/workflows/bot_pr_approval.yaml b/.github/workflows/bot_pr_approval.yaml
index e38c5841..887a994a 100644
--- a/.github/workflows/bot_pr_approval.yaml
+++ b/.github/workflows/bot_pr_approval.yaml
@@ -5,5 +5,8 @@ on:
 
 jobs:
   bot_pr_approval:
+    if: github.event.pull_request.user.login != 'github-actions[bot]'
     uses: canonical/operator-workflows/.github/workflows/bot_pr_approval.yaml@main
+    permissions:
+      pull-requests: write
     secrets: inherit
diff --git a/docs/how-to/upgrade.md b/docs/how-to/upgrade.md
index 46fcb914..808945db 100644
--- a/docs/how-to/upgrade.md
+++ b/docs/how-to/upgrade.md
@@ -4,4 +4,4 @@ Upgrade the `github-runner-image-builder-operator` charm with the `refresh` comm
 
 ```bash
 juju refresh github-runner-image-builder
-```
+```
\ No newline at end of file
diff --git a/docs/reference/charm-architecture.md b/docs/reference/charm-architecture.md
index e86ccd4b..ab9d22d5 100644
--- a/docs/reference/charm-architecture.md
+++ b/docs/reference/charm-architecture.md
@@ -44,7 +44,7 @@ which can then be reused by the other charm to spawn VM instances with the neces
 The image-builder uses the [OpenStack SDK](https://docs.openstack.org/openstacksdk/latest/)  to spawn a VM instance in a cloud specified
 by a config option. Using an external OpenStack VM instead of the charm's machine allows for more features
 (using chroot has some limitations, e.g. for building snaps) and parallel image building.
-[cloud-init](https://cloud-init.io/) is used to install the necessary dependencies for spawning self-hosted runners
+[cloud-init](https://github.com/canonical/cloud-init) is used to install the necessary dependencies for spawning self-hosted runners
 ([GitHub Actions runner binary](https://github.com/actions/runner)) and tools for automatic proxy support ([aproxy](https://github.com/canonical/aproxy)). 
 There is also a custom script configuration combined with a secret that is run in the cloud-init script to allow further customization of the images.
 The image-builder repeatedly checks to see if the cloud-init script has finished successfully, then snapshots the VM, uploads the image to a specified OpenStack project