diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml
index ad3a32a..b47fff3 100644
--- a/.github/workflows/__shared-ci.yml
+++ b/.github/workflows/__shared-ci.yml
@@ -4,8 +4,10 @@ on:
   workflow_call:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
+  statuses: write
   # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
   id-token: write
 
diff --git a/.github/workflows/main-ci.yml b/.github/workflows/main-ci.yml
index 72ed54f..02c2c19 100644
--- a/.github/workflows/main-ci.yml
+++ b/.github/workflows/main-ci.yml
@@ -6,10 +6,12 @@ on:
     tags: ['*']
 
 permissions:
+  actions: read
   contents: read
   id-token: write
   pages: write
   security-events: write
+  statuses: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -61,7 +63,7 @@ jobs:
       url: ${{ steps.deployment.outputs.url }}
     steps:
       - id: deployment
-        uses: hoverkraft-tech/ci-github-publish/actions/deploy/github-pages@0.8.0
+        uses: hoverkraft-tech/ci-github-publish/actions/deploy/github-pages@6d9e5d48da1a80c085e8ed867d680a5e99b28217 # 0.8.0
         with:
           build-path: docs/build
           build-artifact-name: build
diff --git a/.github/workflows/pull-request-ci.yml b/.github/workflows/pull-request-ci.yml
index c710544..5ab349f 100644
--- a/.github/workflows/pull-request-ci.yml
+++ b/.github/workflows/pull-request-ci.yml
@@ -6,8 +6,10 @@ on:
     branches: [main]
 
 permissions:
+  actions: read
   contents: read
   security-events: write
+  statuses: write
   # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
   id-token: write
 
diff --git a/package.json b/package.json
index 5f14af2..f437b8c 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,8 @@
     "format": "prettier --write \"src/**/*.{ts,tsx,css}\"",
     "format:check": "prettier --check \"src/**/*.{ts,tsx,css}\"",
     "prepublishOnly": "npm run build",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "test:ci": "echo \"No tests specified yet\" && exit 0"
   },
   "keywords": [
     "docusaurus",