diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2f400c70..1710d518 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,19 +2,21 @@ name: tests
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: read-all
+
 jobs:
   code-analysis:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Set up JDK 8
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'adopt'
           java-version: '8'
       - name: Cache Maven packages
-        uses: actions/cache@v2
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-m2-ca-${{ hashFiles('**/pom.xml') }}
@@ -25,14 +27,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Set up JDK 8
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'adopt'
           java-version: '8'
       - name: Cache Maven packages
-        uses: actions/cache@v2
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-m2-ut-${{ hashFiles('**/pom.xml') }}
@@ -40,7 +42,7 @@ jobs:
       - name: Unit Tests
         run: mvn --batch-mode --activate-profiles github test jacoco:report
       - name: Upload test coverage report
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           files: ./ecaudit/target/site/jacoco/jacoco.xml,./common/target/site/jacoco/jacoco.xml,./eclog/target/site/jacoco/jacoco.xml
           flags: unit-tests
@@ -50,14 +52,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Set up JDK 8
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'adopt'
           java-version: '8'
       - name: Cache Maven packages
-        uses: actions/cache@v2
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-m2-it-${{ hashFiles('**/pom.xml') }}