diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d31399e..2d5e55d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,11 @@ on:
     push:
         branches: [main]
 
+permissions:
+    # Required for OIDC: https://docs.npmjs.com/trusted-publishers
+    id-token: write
+    contents: read
+
 # Ensure that only one instance of this workflow executes at a time.
 # If multiple PRs are merged in quick succession, there will only ever be one publish workflow running and one pending.
 concurrency: ${{ github.workflow }}
diff --git a/.github/workflows/style_and_syntax_checks.yml b/.github/workflows/style_and_syntax_checks.yml
index 97ce30a..829a2a8 100644
--- a/.github/workflows/style_and_syntax_checks.yml
+++ b/.github/workflows/style_and_syntax_checks.yml
@@ -8,13 +8,13 @@ jobs:
     checks:
         runs-on: ubuntu-latest
         steps:
-            - name: Checkout code
-              uses: actions/checkout@v3
+            # v4.2.2
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
-            - name: Setup Node
-              uses: actions/setup-node@v3
+            # v4.3.0
+            - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e
               with:
-                  node-version: 18
+                  node-version-file: '.nvmrc'
                   cache: npm
 
             - name: Install dependencies
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 0000000..0a49261
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.11.0