diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2fde716..0b6abd0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,6 +12,9 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
 
@@ -20,7 +23,7 @@ jobs:
           python-version: "3.8"
           cache: "pip"
 
-      - uses: FedericoCarboni/setup-ffmpeg@v2
+      - uses: FedericoCarboni/setup-ffmpeg@583042d32dd1cabb8bd09df03bde06080da5c87c # v2
 
       - name: Install dependencies and package
         run: pip install -e . mypy coverage
diff --git a/aligner/tests/test_cli.py b/aligner/tests/test_cli.py
index aa883c5..a00e624 100644
--- a/aligner/tests/test_cli.py
+++ b/aligner/tests/test_cli.py
@@ -22,6 +22,8 @@
 from ..classes import Segment
 from ..cli import app
 
+VERBOSE_OVERRIDE = bool(os.environ.get("EVERYVOICE_VERBOSE_TESTS", False))
+
 
 class CLITest(TestCase):
     def setUp(self) -> None:
@@ -83,8 +85,12 @@ def test_align_something(self):
             wav = tmppath / "ej-fra.wav"
             # Under most circumstances, align can take a .m4a input file, but not
             # in CI. It's not a hard requirement, so just convert to .wav.
-            subprocess.run(["ffmpeg", "-i", m4a, wav], capture_output=True)
-            # os.system("ls -la " + tmpdir)
+            result = subprocess.run(["ffmpeg", "-i", m4a, wav], capture_output=True)
+            if result.returncode != 0 or VERBOSE_OVERRIDE:
+                print("ffmpeg output:", result.stdout, result.stderr)
+                print("ffmpeg exit code:", result.returncode)
+                print(tmpdir)
+                os.system("ls -la " + tmpdir)
             textgrid = tmppath / "ej-fra-16000.TextGrid"
             wav_out = tmppath / "ej-fra-16000.wav"