diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13d5ea3..51fdf4f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,8 @@ on:
     branches: [ main ]
     paths-ignore:
       - "**.md"
+permissions:
+  contents: read
 
 jobs:
   ci:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1cd89ac..5ee6e27 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -10,7 +10,6 @@
 # supported CodeQL languages.
 #
 name: "CodeQL"
-
 on:
   push:
     branches: [ "main" ]
@@ -18,6 +17,8 @@ on:
     branches: [ "main" ]
   schedule:
     - cron: '33 12 * * 2'
+permissions:
+  contents: read
 
 jobs:
   analyze:
diff --git a/.github/workflows/email.yml b/.github/workflows/email.yml
index bb073ab..fe66eb4 100644
--- a/.github/workflows/email.yml
+++ b/.github/workflows/email.yml
@@ -3,6 +3,8 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 0 * * *'
+permissions:
+  contents: read
 
 jobs:
   run:
@@ -14,7 +16,7 @@ jobs:
         with:
           organization: ${{ secrets.ORG }}
           github-token: ${{ secrets.TOKEN }}
-      - uses: austenstone/job-summary-to-pdf@main
+      - uses: austenstone/job-summary-to-pdf@v1.0
         id: pdf
         with:
           name: copilot-usage
diff --git a/.github/workflows/usage.yml b/.github/workflows/usage.yml
index 3adedb9..d8cde41 100644
--- a/.github/workflows/usage.yml
+++ b/.github/workflows/usage.yml
@@ -3,6 +3,8 @@ on:
   push:
   pull_request:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   run:
diff --git a/README.md b/README.md
index 57349c2..da4755b 100644
--- a/README.md
+++ b/README.md
@@ -36,14 +36,14 @@ jobs:
     name: Run Action
     runs-on: ubuntu-latest
     steps:
-      - uses: austenstone/copilot-usage@main
+      - uses: austenstone/copilot-usage@v3
         with:
           github-token: ${{ secrets.TOKEN }}
 ```
 ## Example get team usage
 
 ```yml
-      - uses: austenstone/copilot-usage@main
+      - uses: austenstone/copilot-usage@v3
         with:
           github-token: ${{ secrets.TOKEN }}
           organization: 'org-slug'
@@ -53,7 +53,7 @@ jobs:
 ## Example get enterprise usage
 
 ```yml
-      - uses: austenstone/copilot-usage@main
+      - uses: austenstone/copilot-usage@v3
         with:
           github-token: ${{ secrets.TOKEN }}
           enterprise: 'enterprise-slug'
@@ -75,10 +75,10 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: austenstone/copilot-usage@main
+      - uses: austenstone/copilot-usage@v3
         with:
           github-token: ${{ secrets.TOKEN }}
-      - uses: austenstone/job-summary-to-pdf@main
+      - uses: austenstone/job-summary-to-pdf@v1.0
         id: pdf
         with:
           name: copilot-usage