diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index 550717b..6c50439 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -16,4 +16,5 @@ jobs:
           curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
         continue-on-error: true
 permissions:
+  actions: read
   contents: read
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 611225d..4a0c17f 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e225014..1d73373 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index ca86baa..ef640a5 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -41,6 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
+  actions: read
   contents: write        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index 94ee02a..090c7c5 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
     branches: [main, master]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
index e41548a..0c0215f 100644
--- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml
+++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
@@ -19,6 +19,7 @@ on:
     types: [created]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/haskell.yml b/.github/workflows/haskell.yml
index b4fdede..49ac7ae 100644
--- a/.github/workflows/haskell.yml
+++ b/.github/workflows/haskell.yml
@@ -8,6 +8,7 @@ on:
     branches: [ "main" ]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 228dc43..0f86f6c 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 81e9903..d9685fd 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,9 +7,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
     secrets: inherit
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index a1a1aa3..31f3ddc 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/php-security.yml b/.github/workflows/php-security.yml
index 69194c9..e7a3ea8 100644
--- a/.github/workflows/php-security.yml
+++ b/.github/workflows/php-security.yml
@@ -13,6 +13,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index f8f3fa4..e9ddad3 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
 on:
   push: {}
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 11d9b2a..04f07e0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -8,10 +8,11 @@ on:
 
 permissions:
   contents: read
-
+  security-events: write
+  id-token: write
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 5844dfb..a387345 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:
diff --git a/.mise.toml b/.mise.toml
new file mode 100644
index 0000000..d033e51
--- /dev/null
+++ b/.mise.toml
@@ -0,0 +1,2 @@
+[tools]
+just = "1.36.0"
diff --git a/.tool-versions b/.tool-versions
deleted file mode 100644
index 185ff65..0000000
--- a/.tool-versions
+++ /dev/null
@@ -1 +0,0 @@
-just 1.36.0