diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index c010ba8c1..a4042b8bc 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @github/semantic-code
+* @github/semantic-code @github/blackbird
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index adc70b3c8..e8bb697e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,5 @@
 name: Continuous integration
+
 on:
   push:
     branches: [main]
@@ -6,6 +7,9 @@ on:
   schedule:
     - cron: "0 0 1,15 * *"
 
+permissions:
+  contents: read
+
 # In the event that there is a new push to the ref, cancel any running jobs because there are now obsolete, and wasting resources.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,7 +27,7 @@ jobs:
 
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: ${{ matrix.rust }}
       - name: Install cargo-hack
@@ -75,7 +79,7 @@ jobs:
 
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: ${{ matrix.rust }}
       - name: Checkout code
@@ -116,7 +120,7 @@ jobs:
 
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: ${{ matrix.rust }}
       - name: Install cargo-hack
@@ -148,7 +152,7 @@ jobs:
 
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: ${{ matrix.rust }}
       - name: Cache dependencies
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 7da0f9ef8..d68ffa75d 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -1,9 +1,14 @@
 name: Performance testing
+
 on:
   pull_request:
     paths:
       - 'stack-graphs/**'
 
+permissions:
+  contents: read
+  pull-requests: write
+
 # In the event that there is a new push to the ref, cancel any running jobs because there are now obsolete, and wasting resources.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -79,7 +84,7 @@ jobs:
       BASE_SHA: ${{ needs.changes.outputs.base-sha }}
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: stable
       - name: Cache Rust dependencies
@@ -148,7 +153,7 @@ jobs:
       HEAD_SHA: ${{ needs.changes.outputs.head-sha }}
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
         with:
           rust-version: stable
       - name: Cache Rust dependencies
diff --git a/.github/workflows/publish-lsp-positions.yml b/.github/workflows/publish-lsp-positions.yml
index dd021646b..2ca05a133 100644
--- a/.github/workflows/publish-lsp-positions.yml
+++ b/.github/workflows/publish-lsp-positions.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - lsp-positions-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './lsp-positions'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/lsp-positions.
diff --git a/.github/workflows/publish-stack-graphs.yml b/.github/workflows/publish-stack-graphs.yml
index b94e0337f..29b21020b 100644
--- a/.github/workflows/publish-stack-graphs.yml
+++ b/.github/workflows/publish-stack-graphs.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - stack-graphs-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './stack-graphs'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/stack-graphs.
diff --git a/.github/workflows/publish-tree-sitter-stack-graphs-java.yml b/.github/workflows/publish-tree-sitter-stack-graphs-java.yml
index 64e9f3bf2..40878de95 100644
--- a/.github/workflows/publish-tree-sitter-stack-graphs-java.yml
+++ b/.github/workflows/publish-tree-sitter-stack-graphs-java.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - tree-sitter-stack-graphs-java-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './languages/tree-sitter-stack-graphs-java'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/tree-sitter-stack-graphs-java.
diff --git a/.github/workflows/publish-tree-sitter-stack-graphs-javascript.yml b/.github/workflows/publish-tree-sitter-stack-graphs-javascript.yml
index 48375d9d4..b9fbceec3 100644
--- a/.github/workflows/publish-tree-sitter-stack-graphs-javascript.yml
+++ b/.github/workflows/publish-tree-sitter-stack-graphs-javascript.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - tree-sitter-stack-graphs-javascript-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './languages/tree-sitter-stack-graphs-javascript'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/tree-sitter-stack-graphs-javascript.
diff --git a/.github/workflows/publish-tree-sitter-stack-graphs-python.yml b/.github/workflows/publish-tree-sitter-stack-graphs-python.yml
index 77804c28e..dc90a6974 100644
--- a/.github/workflows/publish-tree-sitter-stack-graphs-python.yml
+++ b/.github/workflows/publish-tree-sitter-stack-graphs-python.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - tree-sitter-stack-graphs-python-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './languages/tree-sitter-stack-graphs-python'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/tree-sitter-stack-graphs-python.
diff --git a/.github/workflows/publish-tree-sitter-stack-graphs-typescript.yml b/.github/workflows/publish-tree-sitter-stack-graphs-typescript.yml
index 3fdbe17e2..9eb696e2a 100644
--- a/.github/workflows/publish-tree-sitter-stack-graphs-typescript.yml
+++ b/.github/workflows/publish-tree-sitter-stack-graphs-typescript.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - tree-sitter-stack-graphs-typescript-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './languages/tree-sitter-stack-graphs-typescript'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/tree-sitter-stack-graphs-typescript.
diff --git a/.github/workflows/publish-tree-sitter-stack-graphs.yml b/.github/workflows/publish-tree-sitter-stack-graphs.yml
index 2dfb743a1..0bf56c143 100644
--- a/.github/workflows/publish-tree-sitter-stack-graphs.yml
+++ b/.github/workflows/publish-tree-sitter-stack-graphs.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - tree-sitter-stack-graphs-v*
 
+permissions:
+  contents: write
+
 jobs:
   publish-crate:
     runs-on: ubuntu-latest
@@ -14,7 +17,7 @@ jobs:
       CRATE_DIR: './tree-sitter-stack-graphs'
     steps:
       - name: Install Rust environment
-        uses: hecrj/setup-rust-action@v1
+        uses: hecrj/setup-rust-action@110f36749599534ca96628b82f52ae67e5d95a3c # v2
       - name: Checkout repository
         uses: actions/checkout@v4
       # TODO Verify the crate version matches the tag
@@ -38,7 +41,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Create GitHub release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
         with:
           body: |
             Find more info on all releases at https://crates.io/crates/tree-sitter-stack-graphs.