diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 6069483..ed6bad7 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -6,13 +6,19 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
         with:
           node-version: '16'