diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index db86156..7da1f95 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,8 @@ updates:
     open-pull-requests-limit: 0
 
   # Maintain dependencies for Composer
+    ignore:
+      - dependency-name: "yiisoft/*"
   - package-ecosystem: "composer"
     directory: "/"
     schedule:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f8bd14f..9a3eb89 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,6 +22,8 @@ on:
 
 name: build
 
+permissions:
+  contents: read
 jobs:
   phpunit:
     uses: yiisoft/actions/.github/workflows/phpunit.yml@master
diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
index c0134fa..b5cb15d 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-require-checker.yml
@@ -24,6 +24,8 @@ on:
 
 name: Composer require checker
 
+permissions:
+  contents: read
 jobs:
   composer-require-checker:
     uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 8150499..c0c78fc 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -20,6 +20,8 @@ on:
 
 name: mutation test
 
+permissions:
+  contents: read
 jobs:
   mutation:
     uses: yiisoft/actions/.github/workflows/roave-infection.yml@master
diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml
index bd79331..ee1364a 100644
--- a/.github/workflows/rector.yml
+++ b/.github/workflows/rector.yml
@@ -11,11 +11,11 @@ on:
 
 name: rector
 
+permissions:
+  contents: read
 jobs:
   rector:
     uses: yiisoft/actions/.github/workflows/rector.yml@master
-    secrets:
-      token: ${{ secrets.YIISOFT_GITHUB_TOKEN }}
     with:
       os: >-
         ['ubuntu-latest']
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 72f669b..5ff6c2f 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -22,6 +22,8 @@ on:
 
 name: static analysis
 
+permissions:
+  contents: read
 jobs:
   psalm:
     uses: yiisoft/actions/.github/workflows/psalm.yml@master