diff --git a/.github/workflows/canary-sunset.yml b/.github/workflows/canary-sunset.yml
index 6b3d4b753..a8ff59c55 100644
--- a/.github/workflows/canary-sunset.yml
+++ b/.github/workflows/canary-sunset.yml
@@ -7,6 +7,9 @@
 # the guard.
 name: Canary sunset
 
+permissions:
+  contents: read
+
 on:
   schedule:
     # Mondays at 15:10 UTC, shortly after the CodeQL run.
@@ -17,8 +20,8 @@ jobs:
   sunset:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
       # No install/build: the script imports the registry source directly and