diff --git a/.github/workflows/celebrate-merge.yml b/.github/workflows/celebrate-merge.yml
index 2fa79f1..ce02871 100644
--- a/.github/workflows/celebrate-merge.yml
+++ b/.github/workflows/celebrate-merge.yml
@@ -9,7 +9,7 @@ jobs:
     if: github.event.pull_request.merged && github.event.pull_request.user.type != 'Bot'
     runs-on: ubuntu-latest
     steps:
-      - uses: YauhenBichel/merge-cheer@v1.7.0
+      - uses: YauhenBichel/merge-cheer@b3d5ac37b98c7dc82063f4771cf7db3da72f4a77 # v1.8.0
         with:
           model: gpt-4o-mini
           model-api-key: ${{ secrets.OPENAI_API_KEY }}
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 54eb5e0..846f2ef 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -18,6 +18,10 @@ name: Contributors
 # a reusable workflow in the same organisation, and the wall lives under
 # YauhenBichel, so inherit passed nothing and the push fell back to the
 # workflow token, which the protected branch refuses.
+#
+# pull-requests: read lets the wall include people who only show up as
+# merged PR authors. The reusable workflow cannot gain that scope unless
+# the caller grants it.
 
 on:
   push:
@@ -28,10 +32,11 @@ on:
 
 permissions:
   contents: write
+  pull-requests: read
 
 jobs:
   wall:
-    uses: YauhenBichel/readme-contributors/.github/workflows/wall.yml@a7a404eee356cff3be78b6aaf419916909994b60 # v1.9.0
+    uses: YauhenBichel/readme-contributors/.github/workflows/wall.yml@3f3b442309052873cae16e7fce8a28f465a88768 # v1.9.2
     with:
       readme: profile/README.md
       format: html