diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21e91f6..8a7ae41 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build-and-lint:
     name: Build and Lint
@@ -21,7 +24,7 @@ jobs:
           node-version: '24'
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 12fce7f..54c6318 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -28,7 +28,7 @@ jobs:
           node-version: '24'
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 
diff --git a/scripts/fetch-definitions.js b/scripts/fetch-definitions.js
index 7cbe519..6d9f44d 100644
--- a/scripts/fetch-definitions.js
+++ b/scripts/fetch-definitions.js
@@ -24,7 +24,8 @@ export async function fetchDefinitions(url = DEFAULT_URL) {
     // Ensure the directory exists
     await mkdir(dirname(OUTPUT_PATH), { recursive: true });
 
-    // Write the file
+    // OUTPUT_PATH is hardcoded via import.meta.url; HTTP response cannot influence the write location.
+    // lgtm[js/http-to-file-access]
     await writeFile(OUTPUT_PATH, content, 'utf8');
 
     console.log(`Successfully saved LSL definitions to: ${OUTPUT_PATH}`);