diff --git a/.github/workflows/deploy_docs_2x.yml b/.github/workflows/deploy_docs_2x.yml
index 15dec27c..4c0a8d5b 100644
--- a/.github/workflows/deploy_docs_2x.yml
+++ b/.github/workflows/deploy_docs_2x.yml
@@ -7,6 +7,9 @@ on:
       - 2.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -17,7 +20,7 @@ jobs:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-2'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/deploy_docs_3x.yml b/.github/workflows/deploy_docs_3x.yml
index aaed049e..4023058a 100644
--- a/.github/workflows/deploy_docs_3x.yml
+++ b/.github/workflows/deploy_docs_3x.yml
@@ -7,6 +7,9 @@ on:
       - 3.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -17,7 +20,7 @@ jobs:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-3'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}
diff --git a/.github/workflows/deploy_docs_4x.yml b/.github/workflows/deploy_docs_4x.yml
index 8f47b950..51ed2821 100644
--- a/.github/workflows/deploy_docs_4x.yml
+++ b/.github/workflows/deploy_docs_4x.yml
@@ -7,6 +7,9 @@ on:
       - 4.x
   workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -17,7 +20,7 @@ jobs:
           fetch-depth: 0
 
       - name: Push to dokku
-        uses: dokku/github-action@master
+        uses: dokku/github-action@cc7dec1d2b9fed249a14ae462bc953bba436f78c # v1.10.0
         with:
           git_remote_url: 'ssh://dokku@apps.cakephp.org:22/authentication-docs-4'
           ssh_private_key: ${{ secrets.DOKKU_SSH_PRIVATE_KEY }}