diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index d66c702..55fb4b2 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -2,13 +2,20 @@ name: verify
 
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
   verify-files:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - name: Set up python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: '3.13'
     - name: Install dependencies
@@ -16,10 +23,10 @@ jobs:
         python3 -m pip install --upgrade pip setuptools wheel
         pip3 install -r requirements.txt
     - name: Store python cache
-      uses: actions/cache@v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/pip
         key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
     - name: Verify changes
       run: |
-        pytest tests
\ No newline at end of file
+        pytest tests