diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6a7c61f..baa13b9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: SonarSource/ci-github-actions/config-pip@master # dogfood
       - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
         with:
           sonar-platform: sqc-eu
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 45997d4..4365b2b 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -8,13 +8,13 @@ jobs:
     runs-on: github-ubuntu-latest-s
     permissions:
       id-token: write
-      contents: read
+      contents: write
     steps:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: SonarSource/ci-github-actions/config-pip@master # dogfood
       - name: Export pip index for isolated hook venvs
         run: |
           index_url="$(python3 -c 'import configparser, pathlib; c = configparser.ConfigParser(); c.read(pathlib.Path.home() / ".pip" / "pip.conf"); print(c["global"]["index-url"])')"
diff --git a/.github/workflows/slack_notify.yml b/.github/workflows/slack_notify.yml
index f18ff5d..8f9e167 100644
--- a/.github/workflows/slack_notify.yml
+++ b/.github/workflows/slack_notify.yml
@@ -5,7 +5,7 @@ on:
     types: [completed]
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
   checks: read
 jobs:
@@ -15,7 +15,7 @@ jobs:
       - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
-      - uses: SonarSource/ci-github-actions/config-pip@v1
+      - uses: SonarSource/ci-github-actions/config-pip@master # dogfood
       - name: Send Slack Notification
         env:
           GITHUB_TOKEN: ${{ github.token }}