diff --git a/.github/workflows/clang-addresssanitizer.yml b/.github/workflows/clang-addresssanitizer.yml
index 8b101185..52c6b0bc 100644
--- a/.github/workflows/clang-addresssanitizer.yml
+++ b/.github/workflows/clang-addresssanitizer.yml
@@ -4,6 +4,7 @@ on:
   pull_request:
   schedule:
     - cron: '13 20 * * SUN'
+permissions: {}
 jobs:
   addresssanitizer:
     name: Clang AddressSanitizer
diff --git a/.github/workflows/clang-analyzer.yml b/.github/workflows/clang-analyzer.yml
index 4bbc76f6..984fbbfa 100644
--- a/.github/workflows/clang-analyzer.yml
+++ b/.github/workflows/clang-analyzer.yml
@@ -4,6 +4,7 @@ on:
   pull_request:
   schedule:
     - cron: '3 20 * * SUN'
+permissions: {}
 jobs:
   clang-analyzer:
     name: Clang static analysis
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 307f5fb8..8adfd7d3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,6 +4,7 @@ on:
   pull_request:
   schedule:
     - cron: '3 20 * * SUN'
+permissions: {}
 jobs:
   test-autoconf:
     strategy:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c09cf120..5c7ec520 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,6 +27,6 @@ jobs:
           enable-cache: false
 
       - name: Run zizmor
-        run: uvx zizmor --format plain .
+        run: uvx zizmor@1.2.2 --format plain .
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}