diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml
index e1472fd..19e2895 100644
--- a/.github/workflows/check-dist.yml
+++ b/.github/workflows/check-dist.yml
@@ -19,6 +19,8 @@ on:
       - '**.md'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   check-dist:
     name: Check dist/
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 91eac76..d8ac898 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,8 @@ on:
       - main
       - 'releases/*'
 
+permissions: {}
+
 jobs:
   test-typescript:
     name: TypeScript Tests
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 2a04f6a..fd9d815 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -10,6 +10,8 @@ on:
   schedule:
     - cron: '31 7 * * 3'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index bb9f8c2..792d239 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -8,6 +8,8 @@ on:
     branches-ignore:
       - main
 
+permissions: {}
+
 jobs:
   lint:
     name: Lint Code Base
@@ -22,6 +24,10 @@ jobs:
       - name: Checkout
         id: checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          # super-linter needs the full git history to get the
+          # list of files that changed across commits
+          fetch-depth: 0
 
       - name: Setup Node.js
         id: setup-node
@@ -36,7 +42,7 @@ jobs:
 
       - name: Lint Code Base
         id: super-linter
-        uses: super-linter/super-linter/slim@a8150b40c89574adb5f68bf9502b890a236a06b3 # v5.7.2
+        uses: super-linter/super-linter/slim@e0fc164bba85f4b58c6cd17ba1dfd435d01e8a06 # v6.3.0
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 886e32f..88805a3 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -4,6 +4,8 @@ on:
     - cron: '30 1 * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   stale:
     uses: mscharley/.github/.github/workflows/stale.yml@main