diff --git a/.github/workflows/build_kernel.yaml b/.github/workflows/build_kernel.yaml
index 0a5baea5..fbcf0bd2 100644
--- a/.github/workflows/build_kernel.yaml
+++ b/.github/workflows/build_kernel.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (${{ matrix.arch }})
     strategy:
       matrix:
@@ -28,7 +32,7 @@ jobs:
       group: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8
@@ -67,6 +71,8 @@ jobs:
             silu-and-mul-kernel
 
   test:
+    permissions:
+      contents: read
     name: Test kernels (UBI ${{ matrix.ubi_version }})
     needs: build
     strategy:
diff --git a/.github/workflows/build_kernel_cpu.yaml b/.github/workflows/build_kernel_cpu.yaml
index fa2f9f05..46142711 100644
--- a/.github/workflows/build_kernel_cpu.yaml
+++ b/.github/workflows/build_kernel_cpu.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/build_kernel_macos.yaml b/.github/workflows/build_kernel_macos.yaml
index 4662586f..d4b0d39a 100644
--- a/.github/workflows/build_kernel_macos.yaml
+++ b/.github/workflows/build_kernel_macos.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: macos-26
     steps:
diff --git a/.github/workflows/build_kernel_rocm.yaml b/.github/workflows/build_kernel_rocm.yaml
index 9c27b837..323a2bde 100644
--- a/.github/workflows/build_kernel_rocm.yaml
+++ b/.github/workflows/build_kernel_rocm.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (ROCm)
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/build_kernel_windows.yaml b/.github/workflows/build_kernel_windows.yaml
index 77c94a98..ef703f4b 100644
--- a/.github/workflows/build_kernel_windows.yaml
+++ b/.github/workflows/build_kernel_windows.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ windows-2022 ]
diff --git a/.github/workflows/build_kernel_xpu.yaml b/.github/workflows/build_kernel_xpu.yaml
index fde968e1..3427ee19 100644
--- a/.github/workflows/build_kernel_xpu.yaml
+++ b/.github/workflows/build_kernel_xpu.yaml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/check_variants.yaml b/.github/workflows/check_variants.yaml
index b999b355..27f0ec49 100644
--- a/.github/workflows/check_variants.yaml
+++ b/.github/workflows/check_variants.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Check build variants
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 161fb940..05c59b8a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,12 @@ env:
   RUFF_VERSION: "0.15.10"
   GRIFFE_VERSION: "1.15.0"
 
+permissions: {}
+
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Run lints
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
           args: format --check
 
   griffe:
+    permissions:
+      contents: read
     name: Check API compatibility
     runs-on: ubuntu-latest
     env:
@@ -49,6 +55,8 @@ jobs:
         run: uvx griffe==${{ env.GRIFFE_VERSION }} check kernels --search kernels/src -a main
 
   validate-dependencies:
+    permissions:
+      contents: read
     name: Validate python_depends.json
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/nix_checks.yml b/.github/workflows/nix_checks.yml
index cb78ec6f..91872692 100644
--- a/.github/workflows/nix_checks.yml
+++ b/.github/workflows/nix_checks.yml
@@ -14,14 +14,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Nix checks
     runs-on:
       group: aws-highmemory-32-plus-nix
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/publish_kernels.yml b/.github/workflows/publish_kernels.yml
index feba692e..1894bed0 100644
--- a/.github/workflows/publish_kernels.yml
+++ b/.github/workflows/publish_kernels.yml
@@ -248,7 +248,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
   github-release:
     name: >-
@@ -320,7 +320,7 @@ jobs:
           path: dist
           merge-multiple: true
       - name: Publish distribution 📦 to TestPyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true # Only upload when the version is unique.
diff --git a/.github/workflows/test_e2e.yaml b/.github/workflows/test_e2e.yaml
index 337a9505..239ef556 100644
--- a/.github/workflows/test_e2e.yaml
+++ b/.github/workflows/test_e2e.yaml
@@ -25,8 +25,12 @@ env:
   E2E_REPO_NAME: kernels-e2e-${{ github.run_id }}-${{ github.run_attempt }}
   E2E_PKG_NAME: kernels_e2e_${{ github.run_id }}_${{ github.run_attempt }}
 
+permissions: {}
+
 jobs:
   init-build-upload:
+    permissions:
+      contents: read
     name: Init, build, and upload kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
@@ -34,7 +38,7 @@ jobs:
       variant: ${{ steps.variant.outputs.name }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8
@@ -109,6 +113,8 @@ jobs:
           nix run $GITHUB_WORKSPACE#kernel-builder -- upload /tmp/${{ env.E2E_REPO_NAME }} --repo-type model
 
   download-and-test:
+    permissions:
+      contents: read
     name: Download and test kernel via get_kernel
     needs: init-build-upload
     runs-on:
@@ -153,6 +159,7 @@ jobs:
           "
 
   cleanup:
+    permissions: {}
     name: Clean up test repos
     needs: [init-build-upload, download-and-test]
     if: always()
diff --git a/.github/workflows/test_extra_commands.yaml b/.github/workflows/test_extra_commands.yaml
index aba224f5..adb4344b 100644
--- a/.github/workflows/test_extra_commands.yaml
+++ b/.github/workflows/test_extra_commands.yaml
@@ -14,13 +14,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 4
diff --git a/.github/workflows/update_cache.yaml b/.github/workflows/update_cache.yaml
index 734caf2d..693601ec 100644
--- a/.github/workflows/update_cache.yaml
+++ b/.github/workflows/update_cache.yaml
@@ -8,8 +8,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Update Nix builder cache (${{ matrix.arch }})
     strategy:
       matrix:
@@ -22,7 +26,7 @@ jobs:
       group: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
         with:
           extra-conf: |
             max-jobs = 8