diff --git a/.github/workflows/PKGBUILD.yml b/.github/workflows/PKGBUILD.yml
index f2b17fe..1101a9b 100644
--- a/.github/workflows/PKGBUILD.yml
+++ b/.github/workflows/PKGBUILD.yml
@@ -20,6 +20,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
 
 
diff --git a/.github/workflows/Test.yml b/.github/workflows/Test.yml
index 22a8e5e..29f7026 100644
--- a/.github/workflows/Test.yml
+++ b/.github/workflows/Test.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 0 * * 3,6'
 
+permissions:
+  contents: read
+
 jobs:
 
 
diff --git a/.github/workflows/Tool.yml b/.github/workflows/Tool.yml
index d205a3c..4498b8b 100644
--- a/.github/workflows/Tool.yml
+++ b/.github/workflows/Tool.yml
@@ -7,6 +7,9 @@ on:
     - cron: '0 0 * * 3'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   matrix:
diff --git a/matrix/action.yml b/matrix/action.yml
index f8ca8d4..b5b66f5 100644
--- a/matrix/action.yml
+++ b/matrix/action.yml
@@ -17,6 +17,8 @@ runs:
     - name: Generate list of jobs
       shell: python
       id: jobs
+      env:
+        INPUT_SYSTEMS: ${{ inputs.systems }}
       run: |
         import os
         icons = {
@@ -28,7 +30,7 @@ runs:
         }
         jobs = [
             {'sys': sys.lower(), 'icon': icons[sys.lower()]}
-            for sys in '${{ inputs.systems }}'.split(' ')
+            for sys in os.environ['INPUT_SYSTEMS'].split(' ')
         ]
         with open(os.environ['GITHUB_OUTPUT'], 'a', encoding='utf-8') as h:
           h.write(f"jobs={jobs!s}\n")