diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 985d2e4206..18eb72a77c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -251,7 +251,7 @@ jobs:
         run: ./monitoring/github_pages/make_site_content.sh
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847  # v3.9.3
         if: github.ref == 'refs/heads/main'
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/monitoring-test.yml b/.github/workflows/monitoring-test.yml
index 2c91b75c3a..8fd8c2d065 100644
--- a/.github/workflows/monitoring-test.yml
+++ b/.github/workflows/monitoring-test.yml
@@ -16,6 +16,8 @@ jobs:
   monitoring-test:
     runs-on: ubuntu-latest
     name: ${{ inputs.name }} test
+    permissions:
+      contents: read
     steps:
     - name: Job information
       run: |