diff --git a/.github/workflows/lint-aliases.yml b/.github/workflows/lint-aliases.yml
index be3730c..ba04e4a 100644
--- a/.github/workflows/lint-aliases.yml
+++ b/.github/workflows/lint-aliases.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w aliases --include-workspace-root
diff --git a/.github/workflows/lint-core.yml b/.github/workflows/lint-core.yml
index c7ae4c3..c14c6cc 100644
--- a/.github/workflows/lint-core.yml
+++ b/.github/workflows/lint-core.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w core --include-workspace-root
diff --git a/.github/workflows/lint-fetchindex.yml b/.github/workflows/lint-fetchindex.yml
index f5829d7..29ba51b 100644
--- a/.github/workflows/lint-fetchindex.yml
+++ b/.github/workflows/lint-fetchindex.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w fetchindex --include-workspace-root
diff --git a/.github/workflows/lint-newest.yml b/.github/workflows/lint-newest.yml
index dd50636..b542e6b 100644
--- a/.github/workflows/lint-newest.yml
+++ b/.github/workflows/lint-newest.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w newest --include-workspace-root
diff --git a/.github/workflows/lint-oldest.yml b/.github/workflows/lint-oldest.yml
index 93dc038..cdcbc04 100644
--- a/.github/workflows/lint-oldest.yml
+++ b/.github/workflows/lint-oldest.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w oldest --include-workspace-root
diff --git a/.github/workflows/lint-opt.yml b/.github/workflows/lint-opt.yml
index de7d5d0..d4ad1a9 100644
--- a/.github/workflows/lint-opt.yml
+++ b/.github/workflows/lint-opt.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w opt --include-workspace-root
diff --git a/.github/workflows/lint-parsefiles.yml b/.github/workflows/lint-parsefiles.yml
index f6d94eb..1f71f86 100644
--- a/.github/workflows/lint-parsefiles.yml
+++ b/.github/workflows/lint-parsefiles.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w parsefiles --include-workspace-root
diff --git a/.github/workflows/lint-ranges.yml b/.github/workflows/lint-ranges.yml
index 597d91f..5c977e7 100644
--- a/.github/workflows/lint-ranges.yml
+++ b/.github/workflows/lint-ranges.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w ranges --include-workspace-root
diff --git a/.github/workflows/lint-static.yml b/.github/workflows/lint-static.yml
index 5510dff..4e09cd7 100644
--- a/.github/workflows/lint-static.yml
+++ b/.github/workflows/lint-static.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w static --include-workspace-root
diff --git a/.github/workflows/lint-translate.yml b/.github/workflows/lint-translate.yml
index 6015aed..be66ff3 100644
--- a/.github/workflows/lint-translate.yml
+++ b/.github/workflows/lint-translate.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w translate --include-workspace-root
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0aaa466..d13c89f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -28,15 +28,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install
diff --git a/.github/workflows/nightly-static-build.yaml b/.github/workflows/nightly-static-build.yaml
index 64b1655..acde442 100644
--- a/.github/workflows/nightly-static-build.yaml
+++ b/.github/workflows/nightly-static-build.yaml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
   run-build:
     runs-on: ubuntu-latest
@@ -12,9 +15,11 @@ jobs:
       pull-requests: write # open or update the data PR and assign it
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: latest
       - name: Run npm install
@@ -30,7 +35,7 @@ jobs:
       - name: Format Output
         run: npm run lint:write -w static
       - name: Create or Update Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           title: 'feat: update data'
           body: 'Updates the static data based on a nightly (or manual) run of the build step in GitHub Actions. Unless the data is invalid, this should be good to go.'
diff --git a/.github/workflows/publish-core.yml b/.github/workflows/publish-core.yml
deleted file mode 100644
index 694e4f3..0000000
--- a/.github/workflows/publish-core.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish core to npmjs.com
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w core
-      - run: npm run lint -w core
-      - run: npm run coverage -w core
-      - run: npm publish --provenance --access public -w core
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-fetchindex.yml b/.github/workflows/publish-fetchindex.yml
deleted file mode 100644
index 1c23374..0000000
--- a/.github/workflows/publish-fetchindex.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/fetchindex to npm
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w fetchindex
-      - run: npm run lint -w fetchindex
-      - run: npm run coverage -w fetchindex
-      - run: npm publish --provenance --access public -w fetchindex
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-newest.yml b/.github/workflows/publish-newest.yml
deleted file mode 100644
index 9b59beb..0000000
--- a/.github/workflows/publish-newest.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/newest to npmjs
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w newest
-      - run: npm run lint -w newest
-      - run: npm run coverage -w newest
-      - run: npm publish --provenance --access public -w newest
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-static.yml b/.github/workflows/publish-static.yml
deleted file mode 100644
index 581578d..0000000
--- a/.github/workflows/publish-static.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/static to npmjs
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w static
-      - run: npm run lint -w static
-      - run: npm run coverage -w static
-      - run: npm publish --provenance --access public -w static
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/tests-core.yml b/.github/workflows/tests-core.yml
index 28537b0..4e19a02 100644
--- a/.github/workflows/tests-core.yml
+++ b/.github/workflows/tests-core.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-fetchindex.yml b/.github/workflows/tests-fetchindex.yml
index 3fae39a..d208222 100644
--- a/.github/workflows/tests-fetchindex.yml
+++ b/.github/workflows/tests-fetchindex.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-newest.yml b/.github/workflows/tests-newest.yml
index 36f0257..51affbe 100644
--- a/.github/workflows/tests-newest.yml
+++ b/.github/workflows/tests-newest.yml
@@ -10,6 +10,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -19,9 +22,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-oldest.yml b/.github/workflows/tests-oldest.yml
index 7395877..ad46d85 100644
--- a/.github/workflows/tests-oldest.yml
+++ b/.github/workflows/tests-oldest.yml
@@ -10,6 +10,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -19,9 +22,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-opt.yml b/.github/workflows/tests-opt.yml
index 3d8949f..a214937 100644
--- a/.github/workflows/tests-opt.yml
+++ b/.github/workflows/tests-opt.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-parsefiles.yml b/.github/workflows/tests-parsefiles.yml
index b668c62..ed69ad0 100644
--- a/.github/workflows/tests-parsefiles.yml
+++ b/.github/workflows/tests-parsefiles.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-ranges.yml b/.github/workflows/tests-ranges.yml
index bb43f5d..f57fe7d 100644
--- a/.github/workflows/tests-ranges.yml
+++ b/.github/workflows/tests-ranges.yml
@@ -11,6 +11,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -20,9 +23,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-static.yml b/.github/workflows/tests-static.yml
index 33c9fc0..5c0f1aa 100644
--- a/.github/workflows/tests-static.yml
+++ b/.github/workflows/tests-static.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-translate.yml b/.github/workflows/tests-translate.yml
index 1522acd..03ba7e7 100644
--- a/.github/workflows/tests-translate.yml
+++ b/.github/workflows/tests-translate.yml
@@ -12,6 +12,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -21,9 +24,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..1e9b3d8
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: 'Linter: workflows'
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - '.github/**'
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload findings to code scanning
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..c66ecaf
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  adhoc-packages:
+    # .npmrc sets package-lock=false, so every npm install is ad hoc by design
+    disable: true