diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index c9d3878a..0ed4f2fe 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -1,16 +1,18 @@
 on: [pull_request]
 
 name: Changelog Reminder
+
+permissions: {} # deny-all default; each job opts in explicitly
+
 jobs:
   remind:
     name: Changelog Reminder
     runs-on: ubuntu-latest
     permissions:
-      issues: write # to create comment
+      pull-requests: write # required: list PR files and post/remove a PR comment
     steps:
-      - uses: actions/checkout@master
       - name: Changelog Reminder
-        uses: peterjgrainger/action-changelog-reminder@v1.2.0
+        uses: peterjgrainger/action-changelog-reminder@de92130a79d81c60dbb7f1ff64244646d138a645 # v1.3.0
         with:
           changelog_regex: 'CHANGELOG\.md'
           customPrMessage: 'Thanks for opening this pull request! Each pull request require an update in the CHANGELOG. Please update it based on your changes.'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de1c4bc4..d12c4866 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,7 +3,6 @@ name: CI
 on:
   push:
     branches:
-      - master
       - main
       - next
   pull_request:
@@ -22,13 +21,13 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Restore dependencies cache
-        uses: actions/cache@v4
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         id: cache
         with:
           path: node_modules
@@ -46,13 +45,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Use Node.js LTS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: lts/*
       - name: Restore dependencies cache
-        uses: actions/cache@v4
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         id: cache
         with:
           path: node_modules
@@ -70,13 +69,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Use Node.js LTS
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: lts/*
       - name: Restore dependencies cache
-        uses: actions/cache@v4
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         id: cache
         with:
           path: node_modules
@@ -92,8 +91,8 @@ jobs:
     name: Test on Bun
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: latest
       - name: Install Dependencies