diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86bc8ff..00fedff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,13 +20,16 @@ jobs:
           # https://github.com/actions/runner-images#available-images
           - os: ubuntu-latest
             locale: C.UTF-8
+            gh_os: linux
           # https://endoflife.date/macos
           - os: macos-latest
             locale: en_US.UTF-8
+            gh_os: macOs
     env:
       LC_ALL: ${{ matrix.locale }}
       LANG: ${{ matrix.locale }}
     steps:
+      ##### Setup environment
       # https://github.com/actions/checkout
       - uses: actions/checkout@v3
       - name: Set up Python
@@ -42,26 +45,26 @@ jobs:
         run: make ci-info
       - name: Install requirements
         run: make bootstrap-dev-plugins
+
+      ##### Run tests, generate bundle
       - name: Run tests
         run: make test
       - name: Create bundle
         run: make bundle
       - name: Test bundle
         run: make ci-test-bundle
+
+      ##### Download gh utility: https://github.com/cli/cli/releases
       - name: Check for presence of "gh" CLI utility
         run: echo "gh_bin=$(which gh)" >> $GITHUB_ENV
-      - name: Download gh utility (linux)
+      - name: Download gh utility
         run: |
-          curl -L -o gh.tar.gz https://github.com/cli/cli/releases/download/v2.20.2/gh_2.20.2_linux_amd64.tar.gz
+          curl -L -o gh.tar.gz https://github.com/cli/cli/releases/download/v2.20.2/gh_2.20.2_${{ matrix.gh_os }}_amd64.tar.gz
           tar xzf gh.tar.gz
-          echo "gh_bin=./gh_2.20.2_linux_amd64/bin/gh" >> $GITHUB_ENV
-        if: ${{ env.gh_bin == '' && !contains(matrix.os, 'macos') }}
-      - name: Download gh utility (macos)
-        run: |
-          curl -L -o gh.tar.gz https://github.com/cli/cli/releases/download/v2.20.2/gh_2.20.2_macOS_amd64.tar.gz
-          tar xzf gh.tar.gz
-          echo "gh_bin=./gh_2.20.2_macOS_amd64/bin/gh" >> $GITHUB_ENV
-        if: ${{ env.gh_bin == '' && contains(matrix.os, 'macos') }}
+          echo "gh_bin=./gh_2.20.2_${{ matrix.gh_os }}_amd64/bin/gh" >> $GITHUB_ENV
+        if: ${{ env.gh_bin == '' }}
+
+      ##### Create release on GitHub
       - name: Create or update GitHub release
         # I wish there was an `--update` option to the `gh release create` command, but
         # there isn't.
@@ -71,8 +74,12 @@ jobs:
           export GH_ARGS="${{ github.ref }} --notes-file=release_description.md"
           echo "gh args: '$GH_ARGS"
           ${{ env.gh_bin }} release create $GH_ARGS || ${{ env.gh_bin }} release edit $GH_ARGS
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Upload release asset to GitHub
         run: |
           export FILENAME="tutor-$(uname -s)_$(uname -m)"
           mv ./dist/tutor $FILENAME
           ${{ env.gh_bin }} release upload --clobber ${{ github.ref }} $FILENAME
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 826957d..58cb2a9 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -8,7 +8,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - name: Add remote
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 11c6578..339a559 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,9 +10,9 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v3
         with:
           python-version: 3.9
       - name: Upgrade pip
diff --git a/tests/commands/base.py b/tests/commands/base.py
index e2f4ed6..e68dc29 100644
--- a/tests/commands/base.py
+++ b/tests/commands/base.py
@@ -32,7 +32,8 @@ class TestCommandMixin:
                 "TUTOR_ROOT": root,
                 "TUTOR_IGNORE_ENTRYPOINT_PLUGINS": "1",
                 "TUTOR_IGNORE_DICT_PLUGINS": "1",
-            }
+            },
+            mix_stderr=False,
         )
         return runner.invoke(
             cli, args, obj=TestContext(root), catch_exceptions=catch_exceptions
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 8563ba5..c6c55e1b 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -70,8 +70,17 @@ class UtilsTests(unittest.TestCase):
         self.assertIsNotNone(imported.q)
 
     def test_is_root(self) -> None:
-        result = utils.is_root()
-        self.assertFalse(result)
+        with patch("sys.platform", "win32"):
+            with patch.object(utils, "get_user_id", return_value=42):
+                self.assertFalse(utils.is_root())
+            with patch.object(utils, "get_user_id", return_value=0):
+                self.assertFalse(utils.is_root())
+
+        with patch("sys.platform", "linux"):
+            with patch.object(utils, "get_user_id", return_value=42):
+                self.assertFalse(utils.is_root())
+            with patch.object(utils, "get_user_id", return_value=0):
+                self.assertTrue(utils.is_root())
 
     @patch("sys.platform", "win32")
     def test_is_root_win32(self) -> None:
@@ -79,11 +88,11 @@ class UtilsTests(unittest.TestCase):
         self.assertFalse(result)
 
     def test_get_user_id(self) -> None:
-        result = utils.get_user_id()
-        if sys.platform == "win32":
-            self.assertEqual(0, result)
-        else:
-            self.assertNotEqual(0, result)
+        with patch("os.getuid", return_value=42):
+            self.assertEqual(42, utils.get_user_id())
+
+            with patch("sys.platform", new="win32"):
+                self.assertEqual(0, utils.get_user_id())
 
     @patch("sys.platform", "win32")
     def test_get_user_id_win32(self) -> None: