diff --git a/.github/workflows/bootloader.yml b/.github/workflows/bootloader.yml
index 2b427d36..bea5ee60 100644
--- a/.github/workflows/bootloader.yml
+++ b/.github/workflows/bootloader.yml
@@ -1,5 +1,8 @@
 name: Build Bootloader
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   workflow_call:
@@ -22,8 +25,10 @@ jobs:
             arch: aarch64
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
           cache-dependency-path: "**/go.sum"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 66c0bad5..0e0c7209 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,8 @@
 name: Release
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -18,8 +21,12 @@ jobs:
             os: macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        with:
+          toolchain: stable
       - name: Build
         run: RUSTFLAGS='-C target-feature=+crt-static' cargo +stable build --target ${{ matrix.target }} --release
       - name: Upload artifact
@@ -35,9 +42,11 @@ jobs:
     needs: [build_alioth, build_bootloader]
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # Required to create/modify releases
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Get tag message
         id: tag_message
         run: |
@@ -64,9 +73,12 @@ jobs:
             -C $PWD/docs macos-signing.md
           xz alioth-*-*.tar
       - name: Create Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
-        with:
-          files: alioth-*-*.tar.xz
-          fail_on_unmatched_files: true
-          draft: true
-          body: ${{ steps.tag_message.outputs.msg }}
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          STEPS_TAG_MESSAGE_OUTPUTS_MSG: ${{ steps.tag_message.outputs.msg }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "Release ${GITHUB_REF_NAME}" \
+            --notes "${STEPS_TAG_MESSAGE_OUTPUTS_MSG}" \
+            --draft \
+            alioth-*-*.tar.xz
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 99579fab..04cb5ec4 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -1,6 +1,7 @@
 name: Rust
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   push:
@@ -35,7 +36,9 @@ jobs:
     runs-on: ${{ matrix.target.os }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
@@ -46,15 +49,17 @@ jobs:
             target/
           key: ${{ matrix.target.name }}-cargo-${{ hashFiles('**/Cargo.lock') }}
       - name: Install nightly Rust
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
         with:
+          toolchain: nightly
           components: rustfmt,llvm-tools
       - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
         with:
+          toolchain: stable
           components: clippy
       - name: Install tools
-        uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2.82.7
+        uses: taiki-e/install-action@065d6a08a14e61e89fb0a4c10eecdbdef39c7d8e # v2.85.4
         with:
           tool: cargo-llvm-cov,cargo-deny
       - name: Check dependencies
@@ -84,7 +89,9 @@ jobs:
     needs: build_test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Download coverage reports
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -96,5 +103,5 @@ jobs:
           sed -i 's#SF:/Users/#SF:/home/#g' lcov/*apple-darwin*.info
           npx lcov-result-merger 'lcov/lcov-*.info' lcov.info
       - name: Upload coverage
-        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         continue-on-error: true