diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 511d7f1..9f24c8c 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -6,32 +6,32 @@ labels: bug
 assignees: fabasoad
 ---
 
-#### Describe the bug
+## Describe the bug
 
 A clear and concise description of what the bug is.
 
-#### Steps to Reproduce
+## Steps to Reproduce
 
 1. Run '...'
 2. See error
 
-#### Expected behavior
+## Expected behavior
 
 A clear and concise description of what you expected to happen.
 
-#### Actual behavior
+## Actual behavior
 
 A clear and concise description of what is happening now.
 
-#### Screenshots
+## Screenshots
 
 If applicable, add screenshots to help explain your problem.
 
-#### Technical information (please complete the following information)
+## Technical information (please complete the following information)
 
 - OS: [e.g. Linux 7ab971b35a78 6.8.4-200.fc39.aarch64]
 - `setup-groff-action` version [e.g. 1.0.0]
 
-#### Additional context
+## Additional context
 
 Add any other context about the problem here.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index e0622c9..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
-    reviewers:
-      - "fabasoad"
-    labels:
-      - "dependencies"
diff --git a/.github/workflows/functional-tests.yml b/.github/workflows/functional-tests.yml
index 5867fd4..6a80dc4 100644
--- a/.github/workflows/functional-tests.yml
+++ b/.github/workflows/functional-tests.yml
@@ -27,6 +27,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # ubuntu is missing here because groff is already installed on ubuntu-latest
+        # runner. Hence, steps.setup-groff.outputs.installed will always be "false".
         os: ["macos"]
     steps:
       - name: Checkout ${{ github.repository }}
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 6840366..7a9777a 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -11,3 +11,5 @@ jobs:
   pre-commit:
     name: Pre-commit
     uses: fabasoad/reusable-workflows/.github/workflows/wf-pre-commit.yml@main
+    permissions:
+      contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa9b621..1d909ce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,3 +10,5 @@ jobs:
   github:
     name: GitHub
     uses: fabasoad/reusable-workflows/.github/workflows/wf-github-release.yml@main
+    permissions:
+      contents: write
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index fcdd924..0529920 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -23,5 +23,5 @@ jobs:
       security-events: write
     uses: fabasoad/reusable-workflows/.github/workflows/wf-security-sast.yml@main
     with:
-      code-scanning: ${{ (inputs.security-type || 'all') == 'all' || inputs.security-type == 'code-scanning' }}
-      sca: ${{ (inputs.security-type || 'all') == 'all' || inputs.security-type == 'sca' }}
+      code-scanning: ${{ contains(fromJSON('["all", "code-scanning"]'), github.event.inputs.security-type || 'all') }}
+      sca: ${{ contains(fromJSON('["all", "sca"]'), github.event.inputs.security-type || 'all') }}
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 42caa8b..5e5343f 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -11,3 +11,7 @@ jobs:
   maintenance:
     name: Maintenance
     uses: fabasoad/reusable-workflows/.github/workflows/wf-sync-labels.yml@main
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
diff --git a/.github/workflows/update-license.yml b/.github/workflows/update-license.yml
index 3b2f09d..07adda6 100644
--- a/.github/workflows/update-license.yml
+++ b/.github/workflows/update-license.yml
@@ -10,3 +10,6 @@ jobs:
   maintenance:
     name: Maintenance
     uses: fabasoad/reusable-workflows/.github/workflows/wf-update-license.yml@main
+    permissions:
+      contents: write
+      pull-requests: write
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b0cd965..72a919b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -45,7 +45,7 @@ repos:
         stages: ["pre-push"]
   # GitHub Actions
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.8
+    rev: v1.7.9
     hooks:
       - id: actionlint
         stages: ["pre-push"]