diff --git a/.github/workflows/clang-addresssanitizer.yml b/.github/workflows/clang-addresssanitizer.yml
index 2d89681..5ab574f 100644
--- a/.github/workflows/clang-addresssanitizer.yml
+++ b/.github/workflows/clang-addresssanitizer.yml
@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: '53 3 * * SUN'
 
+permissions: {}
+
 jobs:
   addresssanitizer:
     name: Clang AddressSanitizer
diff --git a/.github/workflows/clang-analyzer.yml b/.github/workflows/clang-analyzer.yml
index e6a6dec..02fa5bd 100644
--- a/.github/workflows/clang-analyzer.yml
+++ b/.github/workflows/clang-analyzer.yml
@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: '45 3 * * SUN'
 
+permissions: {}
+
 jobs:
   run:
     name: "Clang Static Analysis"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7e28f1c..9caf243 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: '45 3 * * SUN'
 
+permissions: {}
+
 jobs:
   run:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 110e23d..ce71c02 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: '45 3 * * SUN'
 
+permissions: {}
+
 jobs:
   run:
     runs-on: ${{ matrix.operating-system }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c09cf12..5c7ec52 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,6 +27,6 @@ jobs:
           enable-cache: false
 
       - name: Run zizmor
-        run: uvx zizmor --format plain .
+        run: uvx zizmor@1.2.2 --format plain .
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}