diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index beaf1296..e26a5618 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,12 +33,15 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
       - name: Bootstrap
         run: |
           cd /tmp
@@ -51,6 +54,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
+          persist-credentials: false
       - name: Build nrf52840 reference release for 1.2
         run: |
           REFERENCE_PLATFORM=nrf52840 REFERENCE_RELEASE_TYPE=1.2  ./script/make-reference-release.bash
@@ -60,7 +64,7 @@ jobs:
       - name: Build ncs reference release for 1.4
         run: |
           REFERENCE_PLATFORM=ncs REFERENCE_RELEASE_TYPE=1.4 ./script/make-reference-release.bash
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: reference-releases
           path: |