diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index c197d38..d41e2fc 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -9,7 +9,8 @@ on:
   pull_request:
     branches: [master, main]
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   Linter:
@@ -22,4 +23,4 @@ jobs:
       statuses: write
 
     steps:
-      - uses: ivuorinen/actions/pr-lint@db86bb2f0df059edc619ecca735320ed571f51e0 # v2025.12.21
+      - uses: ivuorinen/actions/pr-lint@5b4e9c8e11c0f77ebb0b0a5751e9851f419f4cb8 # v2025.12.22
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index e633fe1..079bb75 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -2,7 +2,8 @@
 # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Sync labels
 
-permissions: read-all
+permissions:
+  contents: read
 
 # yamllint disable-line rule:truthy
 on:
@@ -22,4 +23,4 @@ jobs:
       issues: write
     runs-on: ubuntu-latest
     steps:
-      - uses: ivuorinen/actions/sync-labels@db86bb2f0df059edc619ecca735320ed571f51e0 # v2025.12.21
+      - uses: ivuorinen/actions/sync-labels@5b4e9c8e11c0f77ebb0b0a5751e9851f419f4cb8 # v2025.12.22