diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 096afe74..95f1ee64 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,10 @@
 # https://github.com/fxamacker/cbor/workflows/ci.yml
 # See ci-go-cover.yml for coverage and safer-golangci-lint.yml for linting.
 name: ci
+
+# Revoke default permissions.
+permissions: {}
+
 on:
   workflow_dispatch:
   pull_request:
@@ -14,8 +18,10 @@ on:
 jobs:
   # Test on various OS with default Go version. 
   tests:
-    name: Test on ${{matrix.os}}
+    name: test ${{matrix.os}} go-${{ matrix.go-version }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read    
     strategy:
       matrix:
         os: [macos-latest, ubuntu-latest, windows-latest]
@@ -25,6 +31,7 @@ jobs:
       uses: actions/setup-go@v3
       with:
         go-version: ${{ matrix.go-version }}
+        check-latest: true
         
     - name: Checkout code
       uses: actions/checkout@v3