diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
index 28b8032..a73e4d6 100644
--- a/.github/workflows/integration_test.yml
+++ b/.github/workflows/integration_test.yml
@@ -1,6 +1,13 @@
 name: Integration Tests
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -11,9 +18,9 @@ jobs:
     timeout-minutes: 20
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Checkout test app
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         repository: jamesmartin/inline_svg_test_app
         ref: ${{ matrix.test-branch }}
diff --git a/.github/workflows/rails_6_webpacker_integration_tests.yaml b/.github/workflows/rails_6_webpacker_integration_tests.yaml
index 05149bc..740dd35 100644
--- a/.github/workflows/rails_6_webpacker_integration_tests.yaml
+++ b/.github/workflows/rails_6_webpacker_integration_tests.yaml
@@ -1,6 +1,13 @@
 name: Rails 6 Webpacker Integration Tests (unreliable)
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -11,9 +18,9 @@ jobs:
         test-branch: [rails6-webpacker]
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Checkout test app
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         repository: jamesmartin/inline_svg_test_app
         ref: ${{ matrix.test-branch }}
@@ -47,7 +54,7 @@ jobs:
         node-version: 16
       if: matrix.test-branch == 'rails6-webpacker'
     - name: Set up Python 2.7
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '2.7'
     - name: Generate Webpacker config
diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 4b983f0..c202246 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -1,6 +1,13 @@
 name: Ruby
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -8,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set up Ruby 2.7
       uses: ruby/setup-ruby@v1
       with: