diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 078c850..e4c2a42 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,36 +7,40 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     permissions:
+      # Creating the GitHub Release.
       contents: write
-      packages: write
+      # Trusted Publishing (OIDC) and npm provenance attestations.
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@v7
+
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
-          
+
       - name: Install dependencies
         run: npm ci
-      
+
       - name: Run tests
         run: npm test
-        
+
       - name: Build
         run: npm run build
-      
+
       - name: Publish to npm (Trusted Publishing)
         run: npm publish --provenance --access public
-      
+
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           generate_release_notes: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ccc96fe..39188cf 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,42 +6,49 @@ on:
   pull_request:
     branches: [main, develop]
 
+# Least privilege by default; jobs opt into more only if they need it.
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
-    
+    permissions:
+      contents: read
+
     strategy:
       matrix:
         node-version: [24.x]
-    
+
     steps:
-      - uses: actions/checkout@v4
-      
+      - uses: actions/checkout@v7
+
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
-          
+
       - name: Install dependencies
         run: npm ci
-        
-      - name: Run linter (if configured)
-        run: npm run lint --if-present
-        continue-on-error: true
-        
+
+      # Gating, not advisory. `eslint .` exits non-zero only on errors, so the
+      # pre-existing `no-explicit-any` warnings do not fail the build.
+      - name: Run linter
+        run: npm run lint
+
+      # Also runs the *.test-d.ts type assertions via vitest --typecheck.
       - name: Run tests
         run: npm test
-        
+
       - name: Build
         run: npm run build
-        
+
       - name: Generate coverage report
         run: npm run test:coverage
-        continue-on-error: true
-        
+
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/coverage-final.json
@@ -57,12 +64,14 @@ jobs:
   typescript-next:
     runs-on: ubuntu-latest
     continue-on-error: true
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
           cache: 'npm'