diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a378845..ac5dc07 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,18 +4,26 @@ on:
   push:
     branches:
       - "**"
-  pull_request_target:
+  pull_request:
     types: [opened, reopened, synchronize]
 
 jobs:
   ensure-formatting:
     runs-on: ubuntu-latest
+    permissions:
+      # Enforce least-privilege token access for read-only validation
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+        # Pinned to commit SHA to mitigate third-party action tampering
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        with:
+          # Prevent persisting repository auth token in the workspace
+          persist-credentials: false
 
       - name: Use Node.js 16
-        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
+        # Pinned to commit SHA to mitigate third-party action tampering (SHA points upstream to v3.9.1)
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 16
           cache: "yarn"
@@ -24,4 +32,4 @@ jobs:
         run: yarn install --frozen-lockfile
 
       - name: Run validation script
-        run: node ./ci.js
+        run: node ./ci.js
\ No newline at end of file