diff --git a/.github/workflows/generate-authors.yml b/.github/workflows/generate-authors.yml
index 9a80a48..c7a8404 100644
--- a/.github/workflows/generate-authors.yml
+++ b/.github/workflows/generate-authors.yml
@@ -16,6 +16,8 @@ on:
 
 jobs:
   checksecret:
+    permissions:
+      contents: none
     runs-on: ubuntu-latest
     outputs:
       is_PIONBOT_PRIVATE_KEY_set: ${{ steps.checksecret_job.outputs.is_PIONBOT_PRIVATE_KEY_set }}
@@ -28,6 +30,8 @@ jobs:
           echo "::set-output name=is_PIONBOT_PRIVATE_KEY_set::${{ env.PIONBOT_PRIVATE_KEY != '' }}"
 
   generate-authors:
+    permissions:
+      contents: write
     needs: [checksecret]
     if: needs.checksecret.outputs.is_PIONBOT_PRIVATE_KEY_set == 'true'
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3858008..11b6336 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -16,6 +16,10 @@ on:
       - opened
       - edited
       - synchronize
+
+permissions:
+  contents: read
+
 jobs:
   lint-commit-message:
     name: Metadata
@@ -41,6 +45,9 @@ jobs:
 
   lint-go:
     name: Go
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/renovate-go-mod-fix.yaml b/.github/workflows/renovate-go-mod-fix.yaml
index 5991822..0804642 100644
--- a/.github/workflows/renovate-go-mod-fix.yaml
+++ b/.github/workflows/renovate-go-mod-fix.yaml
@@ -15,6 +15,9 @@ on:
     branches:
       - renovate/*
 
+permissions:
+  contents: write
+
 jobs:
   go-mod-fix:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 80f75d0..282e5d6 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -17,12 +17,16 @@ on:
   pull_request:
     branches:
     - master
+
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go: ["1.16", "1.17"]
+        go: ["1.17", "1.18"]
       fail-fast: false
     name: Go ${{ matrix.go }}
     steps:
@@ -44,9 +48,7 @@ jobs:
           go-version: ${{ matrix.go }}
 
       - name: Setup go-acc
-        run: |
-          go get github.com/ory/go-acc
-          git checkout go.mod go.sum
+        run: go install github.com/ory/go-acc@latest
 
       - name: Set up gotestfmt
         uses: haveyoudebuggedit/gotestfmt-action@v2
@@ -87,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go: ["1.16", "1.17"]
+        go: ["1.17", "1.18"]
       fail-fast: false
     name: Go i386 ${{ matrix.go }}
     steps:
diff --git a/.github/workflows/tidy-check.yaml b/.github/workflows/tidy-check.yaml
index 3ab2c35..fa52ce9 100644
--- a/.github/workflows/tidy-check.yaml
+++ b/.github/workflows/tidy-check.yaml
@@ -18,6 +18,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   Check:
     runs-on: ubuntu-latest