diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml
index 4f5884d9a..a041aea10 100644
--- a/.github/workflows/hugo.yml
+++ b/.github/workflows/hugo.yml
@@ -4,6 +4,8 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 96bc0d334..fc384250f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,8 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   cache-keys:
     name: Setup – Cache keys
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index b1dd9b1be..9e18f0ed5 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -4,6 +4,8 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   prettier:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c09cf1202..5c7ec5209 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,6 +27,6 @@ jobs:
           enable-cache: false
 
       - name: Run zizmor
-        run: uvx zizmor --format plain .
+        run: uvx zizmor@1.2.2 --format plain .
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}