diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..998a0ebe
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
diff --git a/.github/workflows/api-docs.yml b/.github/workflows/api-docs.yml
index 7d0af7e5..2c705ec9 100644
--- a/.github/workflows/api-docs.yml
+++ b/.github/workflows/api-docs.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
+  id-token: write
 
 jobs:
   build-and-deploy:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a92941ea..006703ab 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,8 +5,10 @@ concurrency:
 on:
   pull_request: { types: [opened, reopened, synchronize, ready_for_review] }
   push: { branches: [ main ] }
+permissions:
+  contents: read
 
-jobs: 
+jobs:
   unit-tests:
      uses: vapor/ci/.github/workflows/run-unit-tests.yml@main
      with:
@@ -18,9 +20,9 @@ jobs:
     runs-on: ubuntu-latest
     container: swift:noble
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with: { path: console-kit }
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with: { repository: 'vapor/vapor', path: vapor }
       - run: swift package --package-path vapor edit console-kit --path console-kit
-      - run: SWIFT_DETERMINISTIC_HASHING=1 swift test --package-path vapor
+      - run: swift test --package-path vapor