diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2055b92..36c545e 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,19 +1,26 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Stale
 
-# yamllint disable-line rule:truthy
 on:
   schedule:
-    - cron: "0 8 * * *"
+    - cron: '0 8 * * *' # Every day at 08:00
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: read
+  statuses: read
+
 jobs:
   stale:
+    name: 🧹 Clean up stale issues and PRs
     runs-on: ubuntu-latest
+
     permissions:
       contents: write # only for delete-branch option
       issues: write
       pull-requests: write
     steps:
-      - uses: ivuorinen/actions/stale@main
+      - uses: ivuorinen/actions/stale@9480614ba2231013d99dd5b9c730d2b105b9e160 # 25.6.25