diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml
index 20a484c..a6e1bb6 100644
--- a/.github/workflows/elixir-ci.yml
+++ b/.github/workflows/elixir-ci.yml
@@ -15,11 +15,12 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   elixir-ci:
-    uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@257869d3061d5a8ed1529bf34225d90a2416d51a
     with:
       otp-version: "27.2.1"
       elixir-version: "1.18.2"
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 68c4f3d..9bce625 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,9 +7,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@257869d3061d5a8ed1529bf34225d90a2416d51a
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b1c4cc9..d05b79e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -2,11 +2,13 @@
 name: Scorecards supply-chain security
 
 on:
+  workflow_dispatch:
   branch_protection_rule:
   schedule:
     - cron: '23 4 * * 1'
 
 permissions:
+  actions: read
   contents: read
   security-events: write
   id-token: write
@@ -14,7 +16,9 @@ permissions:
 jobs:
   analysis:
     permissions:
+      actions: read
+      contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@257869d3061d5a8ed1529bf34225d90a2416d51a
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 7ccae92..043df99 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,11 +11,13 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scan:
     permissions:
+      actions: read
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@257869d3061d5a8ed1529bf34225d90a2416d51a
     secrets: inherit