diff --git a/.github/workflows/busted.yml b/.github/workflows/busted.yml
index 8f64d06..1a9d4cb 100644
--- a/.github/workflows/busted.yml
+++ b/.github/workflows/busted.yml
@@ -2,6 +2,8 @@ name: Busted
 
 on: [ push, pull_request ]
 
+permissions: read-all
+
 jobs:
 
   busted:
@@ -9,18 +11,18 @@ jobs:
       fail-fast: false
       matrix:
         luaVersion: [ "5.4", "5.3", "5.2", "5.1", "luajit" ] # , "luajit-openresty"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup ‘lua’
-        uses: leafo/gh-actions-lua@35bcb06abec04ec87df82e08caa84d545348536e # v10
+        uses: luarocks/gh-actions-lua@fc6f8de246f8c01f6e1a56a1b851143e23370ff3 # v12
         with:
           luaVersion: ${{ matrix.luaVersion }}
 
       - name: Setup ‘luarocks’
-        uses: leafo/gh-actions-luarocks@e65774a6386cb4f24e293dca7fc4ff89165b64c5 # v4
+        uses: luarocks/gh-actions-luarocks@95d2308a0aff36ad31ebadca493ed14853399842 # v7
 
       - name: Setup test dependencies
         run: |
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6320b5f..429aa21 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -2,6 +2,8 @@ name: Deploy
 
 on: [ push, workflow_dispatch ]
 
+permissions: read-all
+
 jobs:
 
   affected:
diff --git a/.github/workflows/luacheck.yml b/.github/workflows/luacheck.yml
index 0489df1..a0a3db2 100644
--- a/.github/workflows/luacheck.yml
+++ b/.github/workflows/luacheck.yml
@@ -2,12 +2,14 @@ name: Luacheck
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
 
   luacheck:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Luacheck
         uses: lunarmodules/luacheck@cc089e3f65acdd1ef8716cc73a3eca24a6b845e4 # v1