diff --git a/.github/checks/check_sconscripts.py b/.github/checks/check_sconscripts.py
index be10771..7afd8ca 100644
--- a/.github/checks/check_sconscripts.py
+++ b/.github/checks/check_sconscripts.py
@@ -1,11 +1,21 @@
 #!/usr/bin/env python3
+import fnmatch
 import os
 import re
 import sys
 from pathlib import Path
+import tomllib
+
+_EXCEPTIONS_FILE = Path(__file__).parent / "sconscript_exceptions.toml"
+
+def _LoadExceptions():
+    with open(_EXCEPTIONS_FILE, "rb") as f:
+        data = tomllib.load(f)
+    return data.get("exceptions", {}).get("patterns") or []
+
+EXCEPTIONS = _LoadExceptions()
 
 ROOT       = Path("source")
-EXCLUDED   = {Path("source/lib"), Path("source/raw"), Path("source/scrape")}
 PAPER_DIR  = Path("source/paper")
 PAPER_EXTS = {".bib", ".tex", ".lyx"}
 
@@ -51,8 +61,10 @@ def CollectProblems():
             if parent_content is None:
                 missing_dirs.append(dir_path)
             continue
+        rel = dir_path.relative_to(ROOT).as_posix()
         for f in sorted(f for f in file_names if f != "SConscript"):
-            if ShouldCheck(dir_path, f) and not IsMentioned(content, f, dir_path):
+            path = f"source/{rel}/{f}"
+            if ShouldCheck(dir_path, f) and not IsExcludedFile(path) and not IsMentioned(content, f, dir_path):
                 missing_mentions.append(f"{dir_path} -> {f}")
         for subdir in dir_names:
             if re.search(rf"\b{re.escape(subdir)}\b", content):
@@ -73,7 +85,12 @@ def CollectProblems():
 
 
 def IsExcluded(dir_path):
-    return any(dir_path == e or dir_path.is_relative_to(e) for e in EXCLUDED)
+    s = str(dir_path)
+    return any(fnmatch.fnmatch(s, p) or p.startswith(s + "/") for p in EXCEPTIONS)
+
+
+def IsExcludedFile(path):
+    return any(fnmatch.fnmatch(path, p) for p in EXCEPTIONS)
 
 
 def IsIgnored(name):
diff --git a/.github/checks/sconscript_exceptions.toml b/.github/checks/sconscript_exceptions.toml
new file mode 100644
index 0000000..bc5b5ce
--- /dev/null
+++ b/.github/checks/sconscript_exceptions.toml
@@ -0,0 +1,5 @@
+[exceptions]
+patterns = [
+    "source/lib/*",
+    # "source/some/file.R"
+]
diff --git a/.github/helper_scripts/pr_close_comment.py b/.github/helper_scripts/pr_close_comment.py
index 8685ff1..0f45ac4 100644
--- a/.github/helper_scripts/pr_close_comment.py
+++ b/.github/helper_scripts/pr_close_comment.py
@@ -2,7 +2,7 @@
 import re
 import sys
 from pathlib import Path
-from github import Github
+from github import Auth, Github
 
 ISSUE_TEMPLATE = Path(".github/post_template_issue_thread_pr_close.md")
 PR_TEMPLATE = Path(".github/post_template_pr_thread_pr_close.md")
@@ -16,7 +16,7 @@ def Main():
     branch_name     = os.environ["BRANCH_NAME"]
     last_commit_sha = os.environ["LAST_COMMIT_SHA"]
 
-    repo = Github(github_token).get_repo(repo_name)
+    repo = Github(auth=Auth.Token(github_token)).get_repo(repo_name)
     pr = repo.get_pull(pr_number)
 
     issue_comment_url = PostCommentOnIssueThread(repo, branch_name, last_commit_sha)
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 44e3cc6..ca9ce72 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 1
     permissions:
+      contents: read
       statuses: write
       pull-requests: write
 
diff --git a/.github/workflows/pr-close-comment.yml b/.github/workflows/pr-close-comment.yml
index 5232e55..f0e372e 100644
--- a/.github/workflows/pr-close-comment.yml
+++ b/.github/workflows/pr-close-comment.yml
@@ -5,6 +5,7 @@ on:
     types: [closed]
 
 permissions:
+  contents: read
   issues: write
   pull-requests: write