diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54a7b8a..c53a02d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     branches: [ master ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    uses: evolution-gaming/scala-github-actions/.github/workflows/ci.yml@dde27b9bd793d41d5aacf8fb74403c9de5da1146 # v6.3.0
+    uses: evolution-gaming/scala-github-actions/.github/workflows/ci.yml@61f111a4472fde7b63e5921ac8a238f22d1bb028 # v7.0.1
diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml
index 8430d4a..beacbea 100644
--- a/.github/workflows/dependency-graph.yml
+++ b/.github/workflows/dependency-graph.yml
@@ -9,4 +9,4 @@ permissions:
 
 jobs:
   submit:
-    uses: evolution-gaming/scala-github-actions/.github/workflows/dependency-graph.yml@2a50f1819b6fef2657ba802fd62612b7fc8450f0 # v6.4.0
+    uses: evolution-gaming/scala-github-actions/.github/workflows/dependency-graph.yml@61f111a4472fde7b63e5921ac8a238f22d1bb028 # v7.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2778c64..815e12e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write # can delete tag on failed release attempt
+
 jobs:
   release:
-    uses: evolution-gaming/scala-github-actions/.github/workflows/release.yml@v5
-    secrets: inherit
\ No newline at end of file
+    uses: evolution-gaming/scala-github-actions/.github/workflows/release.yml@61f111a4472fde7b63e5921ac8a238f22d1bb028 # v7.0.1
+    secrets: inherit