diff --git a/.github/workflows/functional-tests.yml b/.github/workflows/functional-tests.yml
index 6a80dc4..0d821ff 100644
--- a/.github/workflows/functional-tests.yml
+++ b/.github/workflows/functional-tests.yml
@@ -24,6 +24,8 @@ jobs:
     name: Setup groff
     runs-on: ${{ matrix.os }}-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -32,11 +34,15 @@ jobs:
         os: ["macos"]
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: "false"
       - name: Setup groff
         id: setup-groff
         uses: ./
       - name: Test action completion
+        env:
+          STEP_SETUP_GROFF_OUTPUT_INSTALLED: "${{ steps.setup-groff.outputs.installed }}"
         run: |
           test_equal() {
             if [ "${2}" != "${3}" ]; then
@@ -45,7 +51,7 @@ jobs:
             fi
           }
           test_equal "groff should be installed" \
-            "${{ steps.setup-groff.outputs.installed }}" \
+            "${STEP_SETUP_GROFF_OUTPUT_INSTALLED}" \
             "true"
       - name: Run script
         run: groff -man -Tascii ./hello-world.roff
@@ -54,15 +60,21 @@ jobs:
     name: Setup groff in container (ubuntu)
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
     container:
-      image: ubuntu:25.04
+      image: ubuntu:26.10
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: "false"
       - name: Setup groff
         id: setup-groff
         uses: ./
       - name: Test action completion
+        env:
+          STEP_SETUP_GROFF_OUTPUT_INSTALLED: "${{ steps.setup-groff.outputs.installed }}"
         run: |
           test_equal() {
             if [ "${2}" != "${3}" ]; then
@@ -71,7 +83,7 @@ jobs:
             fi
           }
           test_equal "groff should be installed" \
-            "${{ steps.setup-groff.outputs.installed }}" \
+            "${STEP_SETUP_GROFF_OUTPUT_INSTALLED}" \
             "true"
       - name: Run script
         run: groff -man -Tascii ./hello-world.roff
@@ -80,13 +92,17 @@ jobs:
     name: Test force
     runs-on: macos-latest
     timeout-minutes: 5
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         force: ["true", "false"]
     steps:
       - name: Checkout ${{ github.repository }}
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: "false"
       - name: Setup groff 1
         id: setup-groff-1
         uses: ./
@@ -96,6 +112,9 @@ jobs:
         with:
           force: ${{ matrix.force }}
       - name: Test action completion
+        env:
+          STEP_SETUP_GROFF_1_OUTPUT_INSTALLED: "${{ steps.setup-groff-1.outputs.installed }}"
+          STEP_SETUP_GROFF_2_OUTPUT_INSTALLED: "${{ steps.setup-groff-2.outputs.installed }}"
         run: |
           test_equal() {
             if [ "${2}" != "${3}" ]; then
@@ -104,8 +123,8 @@ jobs:
             fi
           }
           test_equal "Wrong \"installed\" output from setup-groff-1" \
-            "${{ steps.setup-groff-1.outputs.installed }}" \
+            "${STEP_SETUP_GROFF_1_OUTPUT_INSTALLED}" \
             "true"
           test_equal "Wrong \"installed\" output from setup-groff-2" \
-            "${{ steps.setup-groff-2.outputs.installed }}" \
+            "${STEP_SETUP_GROFF_2_OUTPUT_INSTALLED}" \
             "${{ matrix.force }}"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cd7cf14..8dba57b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -21,7 +21,7 @@ repos:
     hooks:
       - id: detect-secrets
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: v8.30.1
     hooks:
       - id: gitleaks
   # Markdown
diff --git a/README.md b/README.md
index 33f5690..6e0e400 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ jobs:
     name: Setup
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - uses: fabasoad/setup-groff-action@v0
       - run: groff -man -Tascii hello.roff
 ```