diff --git a/.github/workflows/fix-lint.yml b/.github/workflows/fix-lint.yml
deleted file mode 100644
index f1fe6a0..0000000
--- a/.github/workflows/fix-lint.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Autofix Linting
-
-on:
-  issue_comment:
-    types: [created]
-
-# Down scope as necessary via https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
-permissions:
-  checks: write
-  contents: write
-  pull-requests: write
-
-jobs:
-  run-linters:
-    name: Run linters
-    if: github.event.issue.pull_request && ${{ github.event.comment.body == '!fix' }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: GetBranch
-        id: 'get-branch'
-        run: echo ::set-output name=branch::$(gh pr view $PR_NO --repo $REPO --json headRefName --jq '.headRefName')
-        env:
-          REPO: ${{ github.repository }}
-          PR_NO: ${{ github.event.issue.number }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Check out Git repository
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ steps.get-branch.outputs.branch }}
-
-
-      - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: nightly
-      
-      - name: Lint
-        run: |
-          forge fmt
-          pwd
-          if [[ `git diff --exit-code` ]]; then        
-            git config --local user.name 'GitHub Actions Bot'
-            git config --local user.email '<>'
-            git add .
-            git commit -m "Github Actions automatically updated formatting with forge fmt"
-            COMMIT_HASH=$(git rev-parse HEAD)
-            echo "# Github Actions automatically updated formatting with forge fmt\n$COMMIT_HASH" >> .git-blame-ignore-revs
-            git add .git-blame-ignore-revs
-            git commit -m "Updated .git-blame-ignore-revs with commit $COMMIT_HASH"
-            BRANCH_NAME=$(git symbolic-ref --short HEAD)
-            git push origin $BRANCH_NAME
-          fi
-        id: update
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3101011..f89fe9d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,6 +7,10 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+# Read-only. This workflow reports on formatting, it does not change anything.
+permissions:
+  contents: read
+
 env:
   FOUNDRY_PROFILE: ci
 
@@ -18,20 +22,23 @@ jobs:
     name: Foundry project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      # No `ref:` override. On a pull_request event checkout defaults to the
+      # merge commit, which is what CI should be judging. Naming
+      # `github.head_ref` instead resolves a bare branch name against this
+      # repository, so a fork PR whose branch is called `main` gets this
+      # repository's `main` checked out rather than the contributor's code.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.head_ref }}
           submodules: recursive
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1.9.1
         with:
           version: nightly
 
-      - name: Lint
+      - name: Check formatting
         run: |
-          echo "Running forge fmt --check"
-          if ! forge fmt --check; then 
-            echo "The linting check failed. You can fix it locally with 'forge fmt' and then push, or you can have a GitHub action take care of it for you by commenting '!fix' on the PR."
+          if ! forge fmt --check; then
+            echo "::error::Formatting check failed. Run 'forge fmt' locally and commit the result."
             exit 1
-          fi
\ No newline at end of file
+          fi