diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ec6c9f4a4f..5228268d7b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -7,17 +7,18 @@ jobs:
     name: docsite test build
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           show-progress: false
 
       - uses: ./.github/actions/setup-python
-        with:
-          python-version: '3.x'
 
       - name: install tox
-        run: pip install tox
+        run: 'pip install --only-binary :all: tox==4.67.1'
 
       - name: Assure docs can be built
         run: tox -e docs
diff --git a/.github/workflows/label_pr.yml b/.github/workflows/label_pr.yml
index 43f1e3a291..8da7f2053d 100644
--- a/.github/workflows/label_pr.yml
+++ b/.github/workflows/label_pr.yml
@@ -7,16 +7,14 @@ on:
       - reopened
       - synchronize
 
-permissions:
-  contents: write # to determine modified files (actions/labeler)
-  pull-requests: write # to add labels to PRs (actions/labeler)
-
 jobs:
   triage:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     name: Label PR
-
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Label PR
         uses: actions/labeler@v3
@@ -28,19 +26,20 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     name: Label PR - Community
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
           show-progress: false
 
       - uses: ./.github/actions/setup-python
-        with:
-          python-version: '3.x'
 
       - name: Install python requests
-        run: pip install requests
+        run: 'pip install --only-binary :all: requests==2.34.2'
       - name: Check if user is a member of Ansible org
-        uses: jannekem/run-python-script-action@v1
+        uses: jannekem/run-python-script-action@9d8e2e0878d575fb6073277f38ce3f10ebf4f059 # v1
         id: check_user
         with:
           script: |