diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 7cd059ad..8aed3dc4 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -12,6 +12,7 @@ jobs:
     permissions: # https://github.com/dorny/test-reporter/issues/168
       statuses: write
       checks: write
+      contents: read
     steps:
       - uses: actions/checkout@v7
 
@@ -31,7 +32,7 @@ jobs:
         run: go build -o bin/octopus cmd/octopus/main.go
 
       - name: Setup gotestsum
-        run: go install gotest.tools/gotestsum@latest
+        run: go install gotest.tools/gotestsum@v1.13.0
 
       - name: Unit Tests
         run: gotestsum --format testname --junitfile ../unit-tests.xml
diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml
index f8a334c4..f0dc94a0 100644
--- a/.github/workflows/dist.yml
+++ b/.github/workflows/dist.yml
@@ -3,6 +3,9 @@ on:
     branches:
       - release-please--**
 name: "Update Install Script Version"
+# Checkout persists INTEGRATIONS_MD_BOT_TOKEN, which is what the push uses; the default GITHUB_TOKEN only needs read
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 2ffba5bd..bf191a1f 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -51,6 +51,7 @@ jobs:
     permissions: # https://github.com/dorny/test-reporter/issues/168
       statuses: write
       checks: write
+      contents: read
     steps:
       - uses: actions/checkout@v7
 
@@ -60,7 +61,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Setup gotestsum
-        run: go install gotest.tools/gotestsum@latest
+        run: go install gotest.tools/gotestsum@v1.13.0
 
       - name: Integration Tests
         env:
diff --git a/.github/workflows/pr-title-validation.yml b/.github/workflows/pr-title-validation.yml
index cf7aa7f8..fce8f6aa 100644
--- a/.github/workflows/pr-title-validation.yml
+++ b/.github/workflows/pr-title-validation.yml
@@ -5,9 +5,15 @@ on:
   pull_request:
     types: [opened, reopened, edited]
 
+permissions:
+  contents: read
+
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
+    permissions:
+      # The action labels the PR with its conventional commit type
+      pull-requests: write
     steps:
       - name: PR Conventional Commit Validation
         uses: ytanikin/PRConventionalCommits@b628c5a234cc32513014b7bfdd1e47b532124d98 # 1.3.0
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 84163488..fa246cb0 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,6 +3,9 @@ on:
     branches:
       - main
 name: release-please
+# release-please authenticates with INTEGRATIONS_MD_BOT_TOKEN, so the default GITHUB_TOKEN needs nothing beyond read
+permissions:
+  contents: read
 jobs:
   release-please-release:
     runs-on: ubuntu-latest