diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index afda708..e0341b6 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -6,18 +6,23 @@ on:
 
 name: Check
 
+permissions: {}
+
 jobs:
   check:
     name: Check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           submodules: 'recursive'
+          persist-credentials: false
 
       - name: Setup Rust Toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           profile: minimal
           toolchain: stable
@@ -26,12 +31,12 @@ jobs:
         run: rustc -V
 
       - name: cargo check
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: check
 
       - name: cargo test
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: test
 
@@ -39,7 +44,7 @@ jobs:
         run: rustup component add rustfmt
 
       - name: cargo fmt
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: fmt
           args: --all -- --check
@@ -48,7 +53,7 @@ jobs:
         run: rustup component add clippy
 
       - name: cargo clippy
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: clippy
           args: -- -D warnings
diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml
index 330a046..0b1ad47 100644
--- a/.github/workflows/features.yml
+++ b/.github/workflows/features.yml
@@ -6,9 +6,16 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   build:
-    uses: ably/features/.github/workflows/sdk-features.yml@main
+    permissions:
+      contents: read
+      deployments: write
+      id-token: write
+    uses: ably/features/.github/workflows/sdk-features.yml@6b3fc7a8ede2ebdd7a6325314f3a96c6466f1453 # main
     with:
       repository-name: ably-rust
-    secrets: inherit
+    secrets:
+      ABLY_AWS_ACCOUNT_ID_SDK: ${{ secrets.ABLY_AWS_ACCOUNT_ID_SDK }}