diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml
index d8b0a4e..c94e108 100644
--- a/.github/workflows/scan.yaml
+++ b/.github/workflows/scan.yaml
@@ -4,20 +4,26 @@ on:
   schedule:
     - cron: '30 2 * * *'
 
+permissions: {}
+
 jobs:
   scan_images:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Init submodules
         run: git submodule update --init --recursive
       - name: Set up Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.11
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
       - name: Run image
diff --git a/.github/workflows/scan_release.yml b/.github/workflows/scan_release.yml
index 07c6cca..b382703 100644
--- a/.github/workflows/scan_release.yml
+++ b/.github/workflows/scan_release.yml
@@ -7,20 +7,26 @@ on:
         required: true
         default: '0.0.0-dev'
 
+permissions: {}
+
 jobs:
   scan_release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Init submodules
         run: git submodule update --init --recursive
       - name: Set up Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.11
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
       - name: Run image
@@ -35,4 +41,6 @@ jobs:
         run: poetry install
       - name: Scan release
         id: scan
-        run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }}
+        env:
+          RELEASE: ${{ github.event.inputs.release }}
+        run: poetry run python stack_scanner/main.py scan-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE"
diff --git a/.github/workflows/scan_single_image.yml b/.github/workflows/scan_single_image.yml
index 45482c3..a47e32f 100644
--- a/.github/workflows/scan_single_image.yml
+++ b/.github/workflows/scan_single_image.yml
@@ -12,14 +12,20 @@ on:
         description: "Location of the image (example: oci.stackable.tech/sdp/hbase:2.4.17-stackable24.7.0-amd64). Please use the tag for the image itself (usually one including the CPU architecture) and not the tag for the manifest list, since the tag for the manifest list won't have an SBOM attached."
         required: true
 
+permissions: {}
+
 jobs:
   scan_image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.11
       - name: Run image
@@ -30,4 +36,8 @@ jobs:
         run: poetry install
       - name: Scan image
         id: scan
-        run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.image }} ${{ github.event.inputs.product_name }} ${{ github.event.inputs.product_version }}
\ No newline at end of file
+        env:
+          IMAGE: ${{ github.event.inputs.image }}
+          PRODUCT_NAME: ${{ github.event.inputs.product_name }}
+          PRODUCT_VERSION: ${{ github.event.inputs.product_version }}
+        run: poetry run python stack_scanner/main.py scan-image ${{ secrets.SECOBSERVE_API_TOKEN }} "$IMAGE" "$PRODUCT_NAME" "$PRODUCT_VERSION"
\ No newline at end of file
diff --git a/.github/workflows/upload_sbom_release.yml b/.github/workflows/upload_sbom_release.yml
index 4bdebbc..c50a6bb 100644
--- a/.github/workflows/upload_sbom_release.yml
+++ b/.github/workflows/upload_sbom_release.yml
@@ -7,20 +7,26 @@ on:
         required: true
         default: '0.0.0-dev'
 
+permissions: {}
+
 jobs:
   scan_release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Init submodules
         run: git submodule update --init --recursive
       - name: Set up Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
-      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.11
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
       - name: Run image
@@ -35,4 +41,6 @@ jobs:
         run: poetry install
       - name: Upload SBOMs for release
         id: scan
-        run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }}
+        env:
+          RELEASE: ${{ github.event.inputs.release }}
+        run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} "$RELEASE"