diff --git a/.github/workflows/auto-assign-pr.yml b/.github/workflows/auto-assign-pr.yml
index de14a19..a7de556 100644
--- a/.github/workflows/auto-assign-pr.yml
+++ b/.github/workflows/auto-assign-pr.yml
@@ -14,10 +14,14 @@ jobs:
     name: Auto Assign
     # Permissions the called workflow requests (Caller workflow must still grant these scopes to GITHUB_TOKEN)
     permissions:
+      id-token: write
       issues: write
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea # main
+
       - name: Auto assign PR to author (with permission checks)
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
diff --git a/.github/workflows/cargo-update-pr.yml b/.github/workflows/cargo-update-pr.yml
index 90b7234..65873cc 100644
--- a/.github/workflows/cargo-update-pr.yml
+++ b/.github/workflows/cargo-update-pr.yml
@@ -45,6 +45,9 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea # main
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 5ee55b4..9bc8430 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -24,7 +24,13 @@ jobs:
   cargo-deny:
     name: cargo deny check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea # main
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml
new file mode 100644
index 0000000..d21d080
--- /dev/null
+++ b/.github/workflows/dependency-scan.yml
@@ -0,0 +1,13 @@
+name: Dependency Scan
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-scan:
+    uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@25cce154e7fb10f99361a166468a6c56b9c31aa3
+    permissions:
+      contents: read
+      id-token: write
diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml
new file mode 100644
index 0000000..9149ef8
--- /dev/null
+++ b/.github/workflows/scan-github-actions.yml
@@ -0,0 +1,15 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  scan:
+    name: Scan GitHub Actions
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@6a4184039b7a7537d35ace0badc96764d5a1d4d0
+    permissions:
+      actions: read
+      contents: read
+      id-token: write