diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index baaf280..a0f546c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -20,15 +20,21 @@ on:
           A caller must pass `secrets: inherit` for it to arrive at all.
         required: false
 
+# Least privilege. Without this the jobs inherit the calling repository's default token scope,
+# which on an older repository is still read/write on everything. Every job here only reads the
+# tree; the ggshield step authenticates to GitGuardian with its own key, not with GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   composer-audit:
     name: composer audit
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
 
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ inputs.php-version }}
           extensions: ${{ inputs.php-extensions }}
@@ -47,12 +53,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
 
-      - name: Install dependencies (generate composer.lock)
-        # OSV-Scanner reads `composer.lock`. Repos in this suite don't
-        # commit lock files (libraries), so generate one before scanning.
-        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
+      - name: Set up PHP
+        # OSV-Scanner reads `composer.lock`. Repos in this suite don't commit lock files
+        # (libraries), so the next step generates one before scanning.
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           tools: composer:v2
@@ -61,7 +67,7 @@ jobs:
         run: composer install --no-interaction --no-progress --prefer-dist
 
       - name: Run OSV-Scanner
-        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
+        uses: google/osv-scanner-action/osv-scanner-action@32d3cd482bdadfb38b186c0ad1b031902d55d932 # v2.7.1
         with:
           # OSV-scanner v2 changed both flags:
           # - `--skip-git` removed (binary auto-ignores .git/).
@@ -77,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           # ggshield scans the range a pull request adds, so it needs the history to diff against.
           fetch-depth: 0