diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 2a69aa8..8812d50 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -6,10 +6,16 @@ on:
       - main
   pull_request:
 
+permissions: {}
+
 jobs:
   build:
     name: Build (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
+
+    permissions: 
+      contents: read
+
     strategy:
       matrix:
         runner:
@@ -18,10 +24,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           java-version: "11"
           distribution: temurin