diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 9f0d784..22e4f84 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -2,13 +2,19 @@ on:
   pull_request: {}
   schedule:
     - cron: '0 0 * * 6'
+concurrency:
+  group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep-oss
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     container:
       image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.B0
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
       - run: semgrep scan --config=auto
-