diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b06484..ed4dd17 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,13 +5,15 @@ on:
     tags:
       - 'v*'
 
+permissions: read-all
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           files: |
             docs/whitepapers/academic/snif.pdf
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 620ed0a..70b649f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,6 +20,9 @@ permissions:
 
 jobs:
   analysis:
+    permissions:
+      security-events: write
+      id-token: write
     runs-on: ubuntu-latest
     permissions:
       security-events: write