diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml
index 9d6afcf..77f1afc 100644
--- a/.github/workflows/check-pr-title.yml
+++ b/.github/workflows/check-pr-title.yml
@@ -8,6 +8,9 @@ on:
       - ready_for_review
       - reopened
 
+permissions:
+  pull-requests: read
+
 jobs:
   check-pr-title:
     name: Check PR title
diff --git a/.github/workflows/test-and-lint-php.yml b/.github/workflows/test-and-lint-php.yml
index 7156411..4978953 100644
--- a/.github/workflows/test-and-lint-php.yml
+++ b/.github/workflows/test-and-lint-php.yml
@@ -9,6 +9,8 @@ on:
       - 'composer.json'
       - 'composer.lock'
 
+permissions:
+  contents: read
 
 jobs:
   test-and-lint-php:
@@ -28,7 +30,7 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-dependencies
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@2.30.0 # https://github.com/shivammathur/setup-php
+        uses: shivammathur/setup-php@a4e22b60bbb9c1021113f2860347b0759f66fe5d # v2.30.0
         with:
           php-version: 8.3
           coverage: none