diff --git a/.github/workflows/cibuild.yaml b/.github/workflows/cibuild.yaml
index 7e5c2a2..529c97d 100644
--- a/.github/workflows/cibuild.yaml
+++ b/.github/workflows/cibuild.yaml
@@ -1,5 +1,9 @@
 on: push
 name: cibuild
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Test
@@ -10,7 +14,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@540484a3c0f308b08619664ec40bf6c371d172c3 # v1.205.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: script/cibuild
diff --git a/.github/workflows/pages-gem.yml b/.github/workflows/pages-gem.yml
index d60aca7..2c08ac3 100644
--- a/.github/workflows/pages-gem.yml
+++ b/.github/workflows/pages-gem.yml
@@ -4,6 +4,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -11,7 +14,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@540484a3c0f308b08619664ec40bf6c371d172c3 # v1.205.0
         with:
           ruby-version: "3.3"
       - name: Build gem