diff --git a/.github/workflows/pwc-cli-release.yml b/.github/workflows/pwc-cli-release.yml
index 502ea67..6722b72 100644
--- a/.github/workflows/pwc-cli-release.yml
+++ b/.github/workflows/pwc-cli-release.yml
@@ -5,13 +5,15 @@ on:
     tags:
       - "pwc-cli-*"
 
-permissions:
-  contents: write
-  id-token: write
-  attestations: write
+
+permissions: {}
 
 jobs:
   build:
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -24,8 +26,8 @@ jobs:
             target: darwin-arm64
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Build one-file client
         shell: bash
         run: |
@@ -39,23 +41,25 @@ jobs:
             standalone_cli/entrypoint.py
           artifact="dist/pwc-${GITHUB_REF_NAME#pwc-cli-}-${{ matrix.target }}"
           shasum -a 256 "$artifact" > "$artifact.sha256"
-      - uses: actions/attest-build-provenance@v4
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/pwc-*
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pwc-${{ matrix.target }}
           path: dist/pwc-*
 
   release:
+    permissions:
+      contents: write
     needs: build
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: dist
           merge-multiple: true
-      - uses: softprops/action-gh-release@v3
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: dist/pwc-*
           fail_on_unmatched_files: true
diff --git a/.github/workflows/pwc-mcp-release.yml b/.github/workflows/pwc-mcp-release.yml
index 39f7ae8..459c4aa 100644
--- a/.github/workflows/pwc-mcp-release.yml
+++ b/.github/workflows/pwc-mcp-release.yml
@@ -17,8 +17,8 @@ jobs:
   test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Verify hosted read-continuation prerequisite
         if: startsWith(github.ref, 'refs/tags/pwc-mcp-')
         env:
@@ -60,8 +60,8 @@ jobs:
     runs-on: ubuntu-24.04
     environment: hugging-face-space
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       - name: Prepare exact release source
         run: |
           mkdir -p space-release