diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a50b095..c7f15d7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,9 @@ on:
 env:
   RUSTFLAGS: -Dwarnings
 
+permissions:
+  contents: read
+
 jobs:
   build_and_test:
     name: Build and test
@@ -20,28 +23,33 @@ jobs:
         rust: [stable]
 
     steps:
-    - uses: actions/checkout@master
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
 
     - name: Install ${{ matrix.rust }}
-      uses: actions-rs/toolchain@v1
+      uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
       with:
         toolchain: ${{ matrix.rust }}
         override: true
 
     - name: check
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command: check
         args: --all --bins --examples
 
     - name: check unstable
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command:  check
         args: --all --benches --bins --examples --tests
 
     - name: tests
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command: test
         args: --all
@@ -50,8 +58,13 @@ jobs:
     name: Checking fmt and docs
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - uses: actions-rs/toolchain@v1
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
+    - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
       with:
         toolchain: nightly
         components: rustfmt, clippy