diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e7783e7..02f27f3 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -13,9 +13,12 @@ jobs:
           - "3.14"
           - "3.13"
           - "3.12"
+    permissions:
+      contents: read
+
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           tool_versions: |
             python ${{ matrix.python-version }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dcf9344..a2fb199 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index de39893..5b8d9e3 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,3 +1,8 @@
 # Sentinel Security Journal
 
 This journal contains critical security learnings specific to this project.
+
+## 2025-02-14 - Supply Chain Hardening via Action Pinning & Least-Privilege Permissions
+**Vulnerability:** Workflows referenced a mutable and non-existent version tag (`@v7`) for `actions/checkout` and lacked explicit token permissions, leaving them open to potential tag-hijacking supply-chain attacks and overly permissive default GITHUB_TOKEN write access.
+**Learning:** Using tags like `@v4` or `@v7` is insecure because tag references are mutable and can be modified or spoofed by malicious actors in the upstream dependency repository, leading to code injection during CI/CD runs.
+**Prevention:** Always pin third-party GitHub Actions to their secure, immutable full-length commit SHAs and explicitly restrict permissions to `contents: read` at the job level.
diff --git a/tests/test_app.py b/tests/test_app.py
index a1b8895..5c61a0b 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -63,6 +63,6 @@ def test_greet_empty_fallback():
 
 
 if __name__ == "__main__":
-    from pytest import main
+    import pytest
 
-    main()
+    pytest.main()