diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 2d80675..2069a14 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -20,11 +20,11 @@ jobs:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
-    - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
-      with:
-        toolchain: 1.85.0
+    - run: rustup toolchain add ${TOOLCHAIN} && rustup default ${TOOLCHAIN} 
+      env:
+        TOOLCHAIN: 1.85.0
     - uses: taiki-e/install-action@a37010ded18ff788be4440302bd6830b1ae50d8b # v2.68.25
       with:
         tool: cargo-hack@0.6.43
-    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - run: cargo hack test --feature-powerset --locked
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1f5de8f..867cd0d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,9 @@ name: Publish to crates.io
 on:
   push:
     tags: ['v*']  # Triggers when pushing tags starting with 'v'
+
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest