diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 42999ba9..90bc294a 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -2,31 +2,34 @@ name: Ruby
 
 on:
   push:
-    branches: [master]
+    branches: ["master"]
   pull_request:
-    branches: [master]
+    branches: ["master"]
+
+permissions:
+  contents: read
 
 jobs:
   unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-22.04"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Set up Ruby
-        uses: ruby/setup-ruby@ec02537da5712d66d4d50a0f33b7eb52773b5ed1
+        uses: ruby/setup-ruby@55283cc23133118229fd3f97f9336ee23a179fcf # v1.146.0
         with:
-          ruby-version: 3.2.3
-          bundler-cache: true
+          ruby-version: "3.2.3"
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
       - name: Run tests
         run: bin/rails rspec:unit
 
   rubocop:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-22.04"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Set up Ruby
-        uses: ruby/setup-ruby@ec02537da5712d66d4d50a0f33b7eb52773b5ed1
+        uses: ruby/setup-ruby@55283cc23133118229fd3f97f9336ee23a179fcf # v1.146.0
         with:
-          ruby-version: 3.2.3
-          bundler-cache: true
+          ruby-version: "3.2.3"
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
       - name: Run tests
         run: bin/rails rubocop