diff --git a/.github/workflows/audit.yaml b/.github/workflows/audit.yaml
index b1793d16..abf23f4c 100644
--- a/.github/workflows/audit.yaml
+++ b/.github/workflows/audit.yaml
@@ -13,6 +13,8 @@ on:
   schedule:
     - cron: '0 0 * * 0' # Once per week
 
+permissions: {}
+
 jobs:
   security-audit:
     name: "Security audit"
diff --git a/.github/workflows/rust-ci.yaml b/.github/workflows/rust-ci.yaml
index 769ebb96..cce1c8c9 100644
--- a/.github/workflows/rust-ci.yaml
+++ b/.github/workflows/rust-ci.yaml
@@ -31,6 +31,8 @@ jobs:
 
       - name: "Set up Rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
 
       - name: "Build"
         run: cargo build
@@ -53,6 +55,7 @@ jobs:
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          cache: false
           components: clippy, rustfmt
 
       - name: "Check fmt"
diff --git a/.github/workflows/test-android.yaml b/.github/workflows/test-android.yaml
index 5b335b3c..c48d5337 100644
--- a/.github/workflows/test-android.yaml
+++ b/.github/workflows/test-android.yaml
@@ -59,6 +59,8 @@ jobs:
 
       - name: "Set up Rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
 
       - name: "Build Android library"
         run: |
diff --git a/.github/workflows/test-swift.yaml b/.github/workflows/test-swift.yaml
index 10fceec1..ec3afdde 100644
--- a/.github/workflows/test-swift.yaml
+++ b/.github/workflows/test-swift.yaml
@@ -33,6 +33,8 @@ jobs:
 
       - name: "Set up Rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
 
       - name: "Build Swift package"
         run: bash ./build-xcframework.sh
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index d50f1500..fb7d1c0c 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -25,6 +25,8 @@ jobs:
 
       - name: "Set up Rust"
         uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache: false
 
       - name: "Install zizmor"
         run: cargo install zizmor --locked --version 1.6.0