diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 969208e..eeb596e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -4,6 +4,9 @@ on:
     pull_request:
     push:
 
+permissions:
+    contents: read
+
 jobs:
     phpunit:
         name: Test Suite
@@ -12,7 +15,9 @@ jobs:
             matrix:
                 php: [7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4]
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  persist-credentials: false
 
             - name: Install PHP ${{ matrix.php }}
               uses: "shivammathur/setup-php@v2"