diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d046e95..29f6995 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -8,12 +8,18 @@ on:
   pull_request:
     branches: ['main', 'master']
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      checks: write # Required for reviewdog to create check runs.
     steps:
       - name: Checkout repository
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Run golangci-lint
         uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2
@@ -26,11 +32,14 @@ jobs:
     steps:
       - name: Checkout source code
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
         with:
           go-version-file: 'go.mod'
+          cache: false
 
       - name: Install dependencies
         run: go get ./...
@@ -54,7 +63,7 @@ jobs:
           docker build -t controlplane/netassert:${{ github.sha }} .
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: 'controlplane/netassert:${{ github.sha }}'
           format: 'table'
diff --git a/.github/workflows/lint_gha.yaml b/.github/workflows/lint_gha.yaml
new file mode 100644
index 0000000..7490fad
--- /dev/null
+++ b/.github/workflows/lint_gha.yaml
@@ -0,0 +1,32 @@
+name: Lint GitHub Actions
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/*.yaml"
+      - ".github/dependabot.yaml"
+  pull_request:
+    branches: [master]
+    paths:
+      - ".github/workflows/*.yaml"
+      - ".github/dependabot.yaml"
+
+permissions: {}
+
+jobs:
+  lint-gha:
+    name: Lint GitHub Actions
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2043993..f9c9d94 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,11 +6,7 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+"
       - "v[0-9]+.[0-9]+.[0-9]+-testing[0-9]+"
 
-permissions:
-  contents: write
-  packages: write
-  id-token: write
-  attestations: write
+permissions: {}
 
 env:
   GH_REGISTRY: ghcr.io
@@ -22,14 +18,19 @@ env:
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for GoReleaser to create releases and upload assets.
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
         with:
           go-version-file: 'go.mod'
+          cache: false
 
       - uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
 
@@ -43,10 +44,15 @@ jobs:
 
   docker:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # Required for keyless signing with cosign.
+      packages: write # Required to push images to ghcr.io.
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       # - name: Extract metadata (tags, labels) for Docker
       #   id: meta
@@ -95,18 +101,24 @@ jobs:
             SNIFFER_IMG_VERSION=${{ env.SNIFFER_IMG_VERSION }}
 
       - name: Sign artifact
+        env:
+          DIGEST: ${{ steps.buildpush.outputs.digest }}
         run: |
           cosign sign --yes \
-            "${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.buildpush.outputs.digest }}"
+            "${GH_REGISTRY}/${IMAGE_NAME}@${DIGEST}"
           cosign sign --yes \
-            "docker.io/controlplane/netassert@${{ steps.buildpush.outputs.digest }}"
+            "docker.io/controlplane/netassert@${DIGEST}"
 
   helm:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write # Required to push chart to ghcr.io.
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
@@ -115,8 +127,10 @@ jobs:
         uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4
 
       - name: Log in to GitHub Container Registry
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
+          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Prepare and package Helm chart
         run: |