diff --git a/.github/workflows/build_documentation.yaml b/.github/workflows/build_documentation.yaml
index 53febf8d..d2cfbf87 100644
--- a/.github/workflows/build_documentation.yaml
+++ b/.github/workflows/build_documentation.yaml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   build:
-    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main
+    uses: huggingface/doc-builder/.github/workflows/build_main_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169 # main
     with:
       commit_sha: ${{ github.sha }}
       package_path: kernels/kernels/
diff --git a/.github/workflows/build_kernel.yaml b/.github/workflows/build_kernel.yaml
index eae52609..fbcf0bd2 100644
--- a/.github/workflows/build_kernel.yaml
+++ b/.github/workflows/build_kernel.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (${{ matrix.arch }})
     strategy:
       matrix:
@@ -28,7 +32,7 @@ jobs:
       group: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8
@@ -67,6 +71,8 @@ jobs:
             silu-and-mul-kernel
 
   test:
+    permissions:
+      contents: read
     name: Test kernels (UBI ${{ matrix.ubi_version }})
     needs: build
     strategy:
diff --git a/.github/workflows/build_kernel_cpu.yaml b/.github/workflows/build_kernel_cpu.yaml
index 3114a58f..46142711 100644
--- a/.github/workflows/build_kernel_cpu.yaml
+++ b/.github/workflows/build_kernel_cpu.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/build_kernel_macos.yaml b/.github/workflows/build_kernel_macos.yaml
index b30862f5..d4b0d39a 100644
--- a/.github/workflows/build_kernel_macos.yaml
+++ b/.github/workflows/build_kernel_macos.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: macos-26
     steps:
@@ -24,7 +28,7 @@ jobs:
       - name: "Install Metal Toolchain"
         run: xcodebuild -downloadComponent metalToolchain
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         with:
           name: huggingface
diff --git a/.github/workflows/build_kernel_rocm.yaml b/.github/workflows/build_kernel_rocm.yaml
index 8f05922d..323a2bde 100644
--- a/.github/workflows/build_kernel_rocm.yaml
+++ b/.github/workflows/build_kernel_rocm.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (ROCm)
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/build_kernel_windows.yaml b/.github/workflows/build_kernel_windows.yaml
index 87b77040..ef703f4b 100644
--- a/.github/workflows/build_kernel_windows.yaml
+++ b/.github/workflows/build_kernel_windows.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ windows-2022 ]
@@ -113,7 +117,7 @@ jobs:
       # always writes target/ at the workspace root, so caching
       # ./kernel-builder/target would restore to a path cargo never reads.
       - name: Cache cargo + kernel-builder target
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: .
           shared-key: kernel-builder-${{ matrix.os }}
diff --git a/.github/workflows/build_kernel_xpu.yaml b/.github/workflows/build_kernel_xpu.yaml
index e240aa2d..3427ee19 100644
--- a/.github/workflows/build_kernel_xpu.yaml
+++ b/.github/workflows/build_kernel_xpu.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/build_pr_documentation.yaml b/.github/workflows/build_pr_documentation.yaml
index 3255337b..72fcf2cd 100644
--- a/.github/workflows/build_pr_documentation.yaml
+++ b/.github/workflows/build_pr_documentation.yaml
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   build:
-    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main
+    uses: huggingface/doc-builder/.github/workflows/build_pr_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169 # main
     with:
       commit_sha: ${{ github.event.pull_request.head.sha }}
       pr_number: ${{ github.event.number }}
diff --git a/.github/workflows/check_variants.yaml b/.github/workflows/check_variants.yaml
index c51301e3..27f0ec49 100644
--- a/.github/workflows/check_variants.yaml
+++ b/.github/workflows/check_variants.yaml
@@ -14,13 +14,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Check build variants
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
         with:
           nix_path: nixpkgs=channel:nixos-unstable
       - name: Generate variants JSON
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7bd7962b..05c59b8a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,12 @@ env:
   RUFF_VERSION: "0.15.10"
   GRIFFE_VERSION: "1.15.0"
 
+permissions: {}
+
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Run lints
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
           args: format --check
 
   griffe:
+    permissions:
+      contents: read
     name: Check API compatibility
     runs-on: ubuntu-latest
     env:
@@ -42,13 +48,15 @@ jobs:
         with:
           fetch-depth: 0
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           python-version: "3.12"
       - name: Check for breaking changes
         run: uvx griffe==${{ env.GRIFFE_VERSION }} check kernels --search kernels/src -a main
 
   validate-dependencies:
+    permissions:
+      contents: read
     name: Validate python_depends.json
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/nix_checks.yml b/.github/workflows/nix_checks.yml
index f0272cef..91872692 100644
--- a/.github/workflows/nix_checks.yml
+++ b/.github/workflows/nix_checks.yml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Nix checks
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/publish_kernels.yml b/.github/workflows/publish_kernels.yml
index 0c42f7f7..1894bed0 100644
--- a/.github/workflows/publish_kernels.yml
+++ b/.github/workflows/publish_kernels.yml
@@ -248,7 +248,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   github-release:
     name: >-
@@ -270,7 +270,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Sign the dists with Sigstore
-        uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 # v3.4.0
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
         with:
           inputs: >-
             ./dist/*.tar.gz
@@ -320,7 +320,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Publish distribution 📦 to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true # Only upload when the version is unique.
diff --git a/.github/workflows/test_e2e.yaml b/.github/workflows/test_e2e.yaml
index eed583c4..239ef556 100644
--- a/.github/workflows/test_e2e.yaml
+++ b/.github/workflows/test_e2e.yaml
@@ -25,8 +25,12 @@ env:
   E2E_REPO_NAME: kernels-e2e-${{ github.run_id }}-${{ github.run_attempt }}
   E2E_PKG_NAME: kernels_e2e_${{ github.run_id }}_${{ github.run_attempt }}
 
+permissions: {}
+
 jobs:
   init-build-upload:
+    permissions:
+      contents: read
     name: Init, build, and upload kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
@@ -34,7 +38,7 @@ jobs:
       variant: ${{ steps.variant.outputs.name }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8
@@ -109,6 +113,8 @@ jobs:
           nix run $GITHUB_WORKSPACE#kernel-builder -- upload /tmp/${{ env.E2E_REPO_NAME }} --repo-type model
 
   download-and-test:
+    permissions:
+      contents: read
     name: Download and test kernel via get_kernel
     needs: init-build-upload
     runs-on:
@@ -119,7 +125,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv and set Python version
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           python-version: "3.12"
 
@@ -153,12 +159,13 @@ jobs:
           "
 
   cleanup:
+    permissions: {}
     name: Clean up test repos
     needs: [init-build-upload, download-and-test]
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           python-version: "3.12"
       - name: Delete test repos
diff --git a/.github/workflows/test_extra_commands.yaml b/.github/workflows/test_extra_commands.yaml
index 7984f570..adb4344b 100644
--- a/.github/workflows/test_extra_commands.yaml
+++ b/.github/workflows/test_extra_commands.yaml
@@ -14,13 +14,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/test_kernels.yaml b/.github/workflows/test_kernels.yaml
index dfd93e82..e6de0e9b 100644
--- a/.github/workflows/test_kernels.yaml
+++ b/.github/workflows/test_kernels.yaml
@@ -40,7 +40,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv and set the python version
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/update_cache.yaml b/.github/workflows/update_cache.yaml
index e6423e15..693601ec 100644
--- a/.github/workflows/update_cache.yaml
+++ b/.github/workflows/update_cache.yaml
@@ -8,8 +8,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Update Nix builder cache (${{ matrix.arch }})
     strategy:
       matrix:
@@ -22,7 +26,7 @@ jobs:
       group: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8
diff --git a/.github/workflows/upload_pr_documentation.yaml b/.github/workflows/upload_pr_documentation.yaml
index e9678a47..5ad09b08 100644
--- a/.github/workflows/upload_pr_documentation.yaml
+++ b/.github/workflows/upload_pr_documentation.yaml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   build:
-    uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@7ccf6c02dc2e3aea1b07f6668f783b20c3bf407c # main
+    uses: huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml@17ccdf17e0f5e5f88b1ce9f20b3b73fb19017169 # main
     with:
       package_name: kernels
     secrets: