diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index d02135fd..9528d998 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -4,17 +4,23 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        with:
+          persist-credentials: false
 
       - name: Read Tool Versions
         id: tool-versions
         run: echo "::set-output name=nodejs::$(sed -nr 's/nodejs ([0-9]+)/\1/p' .tool-versions)"
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
         with:
           node-version: ${{ steps.tool-versions.outputs.nodejs }}
 
@@ -29,15 +35,19 @@ jobs:
 
   check-go:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        with:
+          persist-credentials: false
 
       - name: Read Tool Versions
         id: tool-versions
         run: echo "::set-output name=golang::$(sed -nr 's/golang ([0-9]+)/\1/p' .tool-versions)"
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
         with:
           go-version: ${{ steps.tool-versions.outputs.golang }}
 
diff --git a/.github/workflows/publish-json-schemas.yml b/.github/workflows/publish-json-schemas.yml
index 4da04658..110d19cf 100644
--- a/.github/workflows/publish-json-schemas.yml
+++ b/.github/workflows/publish-json-schemas.yml
@@ -3,16 +3,21 @@
 
 on: workflow_dispatch
 
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
+      contents: read
+      id-token: write # Required for OIDC assume-role into AWS
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        with:
+          persist-credentials: false
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1
         with:
           aws-region: eu-west-2
           role-to-assume: arn:aws:iam::${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK}}:role/ably-sdk-schemas-ably-common
@@ -22,7 +27,7 @@ jobs:
         id: tool-versions
         run: echo "::set-output name=nodejs::$(sed -nr 's/nodejs ([0-9]+)/\1/p' .tool-versions)"
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
         with:
           node-version: ${{ steps.tool-versions.outputs.nodejs }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 846bf517..02f8ad2c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,18 +3,24 @@
 
 on: workflow_dispatch
 
+permissions: {}
+
 jobs:
   publish-go:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        with:
+          persist-credentials: false
 
       - name: Read Tool Versions
         id: tool-versions
         run: echo "::set-output name=golang::$(sed -nr 's/golang ([0-9]+)/\1/p' .tool-versions)"
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2
         with:
           go-version: ${{ steps.tool-versions.outputs.golang }}
 
diff --git a/.github/workflows/sync-to-s3.yml b/.github/workflows/sync-to-s3.yml
index cfba3ec2..888148b5 100644
--- a/.github/workflows/sync-to-s3.yml
+++ b/.github/workflows/sync-to-s3.yml
@@ -14,20 +14,22 @@ on:
     - cron: "0 2 * * *"
   workflow_dispatch: # Allow manual trigger
 
-permissions:
-  id-token: write # Required for OIDC
-  contents: read
+permissions: {}
 
 jobs:
   generate-and-sync:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC assume-role into AWS
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "18"
           cache: "npm"
@@ -53,7 +55,7 @@ jobs:
           npm run fetch:agent-releases
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1
         with:
           aws-region: eu-west-2
           role-to-assume: arn:aws:iam::${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK}}:role/ably-sdk-schemas-ably-common