diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 350cddf..00e7956 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -7,27 +7,25 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 jobs:
   test:
     name: Test Parade
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.19.0"
+          go-version-file: go.mod
       - name: Test all
         env:
           GO111MODULE: on
         run: |
           make test-coverage
-      - name: Install goveralls
-        env:
-          GO111MODULE: off
-        run: go get github.com/mattn/goveralls
       - name: Send coverage
-        uses: shogo82148/actions-goveralls@v1
+        uses: shogo82148/actions-goveralls@9606dbc5ac5cf888a0e9ef901515c3cd516a2790 # v1.11.0
         with:
           path-to-profile: covprofile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ae20cb..0c2a5f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,22 +4,24 @@ on:
   push:
     tags:
       - v*.*.*
+permissions:
+  contents: write
 jobs:
   release:
     name: Release Parade
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.19"
+          go-version-file: go.mod
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v2
+        uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
         env:
           GO111MODULE: on
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         with:
-          version: latest
+          version: '~> v1'
           args: release --rm-dist