diff --git a/.github/workflows/build-dragonfly-amd64.yml b/.github/workflows/build-dragonfly-amd64.yml
index a9e62fd0ec..c036d0d9d7 100644
--- a/.github/workflows/build-dragonfly-amd64.yml
+++ b/.github/workflows/build-dragonfly-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable DragonFly amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: dragonflybsd
           version: '6.4.2'
@@ -57,7 +60,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-dragonfly-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-freebsd-amd64.yml b/.github/workflows/build-freebsd-amd64.yml
index a6af2cba09..b75d67be89 100644
--- a/.github/workflows/build-freebsd-amd64.yml
+++ b/.github/workflows/build-freebsd-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable FreeBSD amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: freebsd
           version: '15.1'
@@ -58,7 +61,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-freebsd-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-haiku-amd64.yml b/.github/workflows/build-haiku-amd64.yml
index a50550af85..b85fef26e5 100644
--- a/.github/workflows/build-haiku-amd64.yml
+++ b/.github/workflows/build-haiku-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable Haiku amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: haiku
           version: 'r1beta5'
@@ -51,7 +54,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-haiku-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml
index fd73e8a6f7..981ab48c47 100644
--- a/.github/workflows/build-linux-armv7l.yml
+++ b/.github/workflows/build-linux-armv7l.yml
@@ -3,6 +3,9 @@ name: Reusable Linux armv7l
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -11,10 +14,10 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: uraimo/run-on-arch-action@v3
+        uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0
         id: runcmd
         with:
           arch: armv7
@@ -38,7 +41,7 @@ jobs:
             ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-linux-armv7l
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml
index ae0cec9711..bcd5069c42 100644
--- a/.github/workflows/build-linux-hosts.yml
+++ b/.github/workflows/build-linux-hosts.yml
@@ -14,6 +14,10 @@ on:
         description: fastfetch version from linux host build
         value: ${{ jobs.build.outputs.ffversion }}
 
+permissions:
+  security-events: write
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -24,7 +28,7 @@ jobs:
       ffversion: ${{ steps.ffversion.outputs.ffversion }}
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: uname -a
         run: uname -a
@@ -48,7 +52,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: inputs.arch == 'amd64'
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: c
 
@@ -60,7 +64,7 @@ jobs:
 
       - name: perform CodeQL analysis
         if: inputs.arch == 'amd64'
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
       - name: list features
         run: ./fastfetch --list-features
@@ -97,7 +101,7 @@ jobs:
           cpack -V
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-linux-${{ inputs.arch }}
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-linux-i686.yml b/.github/workflows/build-linux-i686.yml
index ed7ab176c3..985b3b089b 100644
--- a/.github/workflows/build-linux-i686.yml
+++ b/.github/workflows/build-linux-i686.yml
@@ -3,6 +3,9 @@ name: Reusable Linux i686
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -11,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: uname -a
         run: uname -a
@@ -64,7 +67,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-linux-i686
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-linux-loong64.yml b/.github/workflows/build-linux-loong64.yml
index 25b140d8f4..4771515cb8 100644
--- a/.github/workflows/build-linux-loong64.yml
+++ b/.github/workflows/build-linux-loong64.yml
@@ -3,6 +3,9 @@ name: Reusable Linux loong64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -11,7 +14,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: set up QEMU for loong64
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
@@ -51,7 +54,7 @@ jobs:
             '
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-linux-loong64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml
index 49600cb5cf..e61a2c52cb 100644
--- a/.github/workflows/build-linux-vms.yml
+++ b/.github/workflows/build-linux-vms.yml
@@ -7,6 +7,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -15,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: uraimo/run-on-arch-action@v3
+        uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0
         id: runcmd
         with:
           arch: ${{ inputs.arch }}
@@ -39,7 +42,7 @@ jobs:
             ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-linux-${{ inputs.arch }}
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-macos-hosts.yml b/.github/workflows/build-macos-hosts.yml
index b5fa76a4e3..66c1666b79 100644
--- a/.github/workflows/build-macos-hosts.yml
+++ b/.github/workflows/build-macos-hosts.yml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -18,7 +21,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: uname -a
         run: uname -a
@@ -53,7 +56,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-macos-${{ inputs.arch }}
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-musl-amd64.yml b/.github/workflows/build-musl-amd64.yml
index 3b4fa86924..07fad3a7f8 100644
--- a/.github/workflows/build-musl-amd64.yml
+++ b/.github/workflows/build-musl-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable Musl amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -10,10 +13,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: setup alpine linux
-        uses: jirutka/setup-alpine@master
+        uses: jirutka/setup-alpine@ae3b3ddba35054804fc4a3507b519fa7e8152050 # v1.4.1
         with:
           branch: edge
 
@@ -41,7 +44,7 @@ jobs:
         shell: alpine.sh {0}
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-musl-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-netbsd-amd64.yml b/.github/workflows/build-netbsd-amd64.yml
index 96b0ba2cc5..9a6283a067 100644
--- a/.github/workflows/build-netbsd-amd64.yml
+++ b/.github/workflows/build-netbsd-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable NetBSD amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: netbsd
           version: '10.1'
@@ -56,7 +59,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-netbsd-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-no-features-test.yml b/.github/workflows/build-no-features-test.yml
index 2dc5bcd210..fadefe8b9d 100644
--- a/.github/workflows/build-no-features-test.yml
+++ b/.github/workflows/build-no-features-test.yml
@@ -3,6 +3,9 @@ name: Reusable No Features Test
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -12,7 +15,7 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: uname -a
         run: uname -a
diff --git a/.github/workflows/build-omnios-amd64.yml b/.github/workflows/build-omnios-amd64.yml
index 2fc5f6ed51..a473b0817a 100644
--- a/.github/workflows/build-omnios-amd64.yml
+++ b/.github/workflows/build-omnios-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable OmniOS amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: omnios
           version: 'r151058'
@@ -61,7 +64,7 @@ jobs:
           cpack -V
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-omnios-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-openbsd-amd64.yml b/.github/workflows/build-openbsd-amd64.yml
index bd400f716d..a22919f69d 100644
--- a/.github/workflows/build-openbsd-amd64.yml
+++ b/.github/workflows/build-openbsd-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable OpenBSD amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -12,10 +15,10 @@ jobs:
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Start VM
-        uses: cross-platform-actions/action@master
+        uses: cross-platform-actions/action@5ea7e8e4677bd726033a10b094ba1c5762b15dee # v1.3.0
         with:
           operating_system: openbsd
           version: '7.9'
@@ -56,7 +59,7 @@ jobs:
         run: ctest --output-on-failure
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-openbsd-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 670286d20d..c5ca7071ac 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -7,23 +7,26 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - name: get latest release version
         id: get_version_release
-        uses: pozetroninc/github-action-get-latest-release@master
+        uses: pozetroninc/github-action-get-latest-release@2a61c339ea7ef0a336d1daa35ef0cb1418e7676c # v0.8.0
         with:
           repository: ${{ github.repository }}
 
       - name: download artifacts
         if: inputs.ffversion != steps.get_version_release.outputs.release
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 
       - name: create release
         if: inputs.ffversion != steps.get_version_release.outputs.release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ inputs.ffversion }}
           commit: ${{ github.sha }}
@@ -50,7 +53,7 @@ jobs:
 
       - name: update release body
         if: inputs.ffversion != steps.get_version_release.outputs.release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ inputs.ffversion }}
           commit: ${{ github.sha }}
diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml
index fd5e75894a..c8e6256201 100644
--- a/.github/workflows/build-solaris-amd64.yml
+++ b/.github/workflows/build-solaris-amd64.yml
@@ -3,6 +3,9 @@ name: Reusable Solaris amd64
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
 
@@ -11,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: vmactions/solaris-vm@v1
+        uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8
         with:
           usesh: true
           envs: 'CMAKE_BUILD_TYPE'
@@ -37,7 +40,7 @@ jobs:
             cpack -V
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-solaris-amd64
           path: ./fastfetch-*.*
diff --git a/.github/workflows/build-spellcheck.yml b/.github/workflows/build-spellcheck.yml
index ade30a6ceb..e57c92218b 100644
--- a/.github/workflows/build-spellcheck.yml
+++ b/.github/workflows/build-spellcheck.yml
@@ -3,13 +3,16 @@ name: Reusable Spellcheck
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     runs-on: ubuntu-latest
 
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install codespell
         shell: bash
diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml
index b2bb9c0eb2..18708f55f3 100644
--- a/.github/workflows/build-windows-hosts.yml
+++ b/.github/workflows/build-windows-hosts.yml
@@ -18,6 +18,18 @@ on:
       msys-arch:
         required: true
         type: string
+    secrets:
+      SIGNPATH_API_TOKEN:
+        description: SignPath REST API token used to submit the signing request
+        # Optional so that runs without the secret (pull requests, forks)
+        # still work; the signing step is skipped there anyway.
+        required: false
+
+permissions:
+  contents: read
+  # The SignPath action reads job details and downloads the unsigned
+  # artifact with the workflow token.
+  actions: read
 
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
@@ -30,10 +42,10 @@ jobs:
         shell: msys2 {0}
     steps:
       - name: checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: setup-msys2
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
         with:
           msystem: ${{ inputs.msystem }}
           update: true
@@ -72,7 +84,7 @@ jobs:
       - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch'
         id: upload-unsigned-artifact
         name: upload artifacts for signing
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-windows-${{ inputs.arch }}
           path: |
@@ -82,7 +94,7 @@ jobs:
 
       - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch'
         name: submit signing request
-        uses: signpath/github-action-submit-signing-request@v1
+        uses: signpath/github-action-submit-signing-request@ced31329c0317e779dad2eec2a7c3bb46ea1343e # v1.3
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
           organization-id: '${{ vars.SIGNPATH_ORG_ID }}'
@@ -99,7 +111,7 @@ jobs:
         run: 7z a -t7z -mx9 -bd -y fastfetch-windows-${{ inputs.arch }}.7z LICENSE *.dll fastfetch.exe flashfetch.exe presets
 
       - name: upload true artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: fastfetch-windows-${{ inputs.arch }}
           path: ./fastfetch-windows-${{ inputs.arch }}.*
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46ac9d4fab..0081e62d88 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,16 +6,16 @@ on:
 
 jobs:
   spellcheck:
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-spellcheck.yml
 
   no-features-test:
     needs: spellcheck
     name: No-features-test
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-no-features-test.yml
-    secrets: inherit
 
   linux-hosts:
     needs: no-features-test
@@ -34,40 +34,32 @@ jobs:
     with:
       arch: ${{ matrix.arch }}
       runs-on: ${{ matrix.runs-on }}
-    secrets: inherit
 
   linux-i686:
     needs: no-features-test
     name: Linux-i686
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-i686.yml
-    secrets: inherit
 
   linux-armv7l:
     needs: no-features-test
     name: Linux-armv7l
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-armv7l.yml
-    secrets: inherit
 
   linux-loong64:
     needs: no-features-test
     name: Linux-loong64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-loong64.yml
-    secrets: inherit
 
   linux-vms:
     needs: no-features-test
     name: Linux-${{ matrix.arch }}
     permissions:
-      security-events: write
       contents: read
     strategy:
       matrix:
@@ -78,19 +70,18 @@ jobs:
     uses: ./.github/workflows/build-linux-vms.yml
     with:
       arch: ${{ matrix.arch }}
-    secrets: inherit
 
   musl-amd64:
     needs: no-features-test
     name: Musl-amd64
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-musl-amd64.yml
-    secrets: inherit
 
   macos-hosts:
     needs: no-features-test
     name: macOS-${{ matrix.arch }}
     permissions:
-      security-events: write
       contents: read
     strategy:
       matrix:
@@ -103,72 +94,65 @@ jobs:
     with:
       arch: ${{ matrix.arch }}
       runs-on: ${{ matrix.runs-on }}
-    secrets: inherit
 
   omnios-amd64:
     needs: no-features-test
     name: OmniOS-amd64
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-omnios-amd64.yml
-    secrets: inherit
 
   solaris-amd64:
     needs: no-features-test
     name: Solaris-amd64
+    permissions:
+      contents: read
     uses: ./.github/workflows/build-solaris-amd64.yml
-    secrets: inherit
 
   freebsd-amd64:
     needs: no-features-test
     name: FreeBSD-amd64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-freebsd-amd64.yml
-    secrets: inherit
 
   openbsd-amd64:
     needs: no-features-test
     name: OpenBSD-amd64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-openbsd-amd64.yml
-    secrets: inherit
 
   netbsd-amd64:
     needs: no-features-test
     name: NetBSD-amd64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-netbsd-amd64.yml
-    secrets: inherit
 
   dragonfly-amd64:
     needs: no-features-test
     name: DragonFly-amd64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-dragonfly-amd64.yml
-    secrets: inherit
 
   haiku-amd64:
     if: false # Disabled because the Haiku build is currently broken
     needs: no-features-test
     name: Haiku-amd64
     permissions:
-      security-events: write
       contents: read
     uses: ./.github/workflows/build-haiku-amd64.yml
-    secrets: inherit
 
   windows-hosts:
     needs: no-features-test
     name: Windows-${{ matrix.arch }}
     permissions:
-      security-events: write
       contents: read
+      # The SignPath action reads job details and downloads the unsigned
+      # artifact with the workflow token.
+      actions: read
     strategy:
       matrix:
         include:
@@ -189,7 +173,8 @@ jobs:
       msystem: ${{ matrix.msystem }}
       msystem-lower: ${{ matrix.msystem-lower }}
       msys-arch: ${{ matrix.msys-arch }}
-    secrets: inherit
+    secrets:
+      SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
 
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'fastfetch-cli/fastfetch'
@@ -215,4 +200,3 @@ jobs:
     uses: ./.github/workflows/build-release.yml
     with:
       ffversion: ${{ needs.linux-hosts.outputs.ffversion }}
-    secrets: inherit