diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 88adb20..80a3ecc 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -4,12 +4,15 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 jobs:
   scan:
     runs-on:  ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - name: Install shellcheck
-      run: sudo apt-get install -y shellcheck
+      run: sudo apt-get update && sudo apt-get install -y shellcheck
     - name: Run tests
       run: ./tests/tests.sh