diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 1ce066c45..a231ef4c4 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -1,13 +1,20 @@
 name: Correctness Checks
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   Run-Markdown-Checks:
+    name: Run Markdown Checks
     runs-on: ubuntu-24.04
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install Python dependencies
-        uses: py-actions/py-dependency-install@v4
+        uses: py-actions/py-dependency-install@9c419aa98bfb42280bdae2b0a736befd9b01e3b1 # v4
         with:
           path: "tools/requirements.txt"
           update-pip: "false"