diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index b7e3a92..a9f8446 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -17,12 +17,12 @@ cache-mode: none
 
 jobs:
   auto-merge-pull-request:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     permissions:
       contents: read
       pull-requests: read
     cache-mode: none
     runs-on: ubuntu-slim
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
       - name: Dependabot metadata
         id: dependabot-metadata
diff --git a/.github/workflows/publish-major-tag.yml b/.github/workflows/publish-major-tag.yml
index dd60cb2..3a18889 100644
--- a/.github/workflows/publish-major-tag.yml
+++ b/.github/workflows/publish-major-tag.yml
@@ -26,8 +26,8 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Create GitHub App Token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.TASTENDRUCK_CLIENT_ID }}
           private-key: ${{ secrets.TASTENDRUCK_PRIVATE_KEY }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 82883e2..32ea342 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,8 +8,6 @@ on:
   push:
     branches:
       - main
-    tags:
-      - '**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }}
@@ -19,7 +17,8 @@ permissions: {}
 
 jobs:
   positive:
-    runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         runs-on:
@@ -84,7 +83,7 @@ jobs:
             source: offline
             case: complex
             verify-attestation: true
-
+    runs-on: ${{ matrix.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -120,23 +119,24 @@ jobs:
         id: golden
 
       - name: Assert constraint output
-        run: exit 1
         if: steps.subject.outputs.constraint != fromJSON(steps.golden.outputs.expected).constraint
+        run: exit 1
 
       - name: Assert versions output
-        run: exit 1
         if: steps.subject.outputs.versions != toJSON(fromJSON(steps.golden.outputs.expected).versions)
+        run: exit 1
 
       - name: Assert lowest output
-        run: exit 1
         if: steps.subject.outputs.lowest != fromJSON(steps.golden.outputs.expected).lowest
+        run: exit 1
 
       - name: Assert highest output
-        run: exit 1
         if: steps.subject.outputs.highest != fromJSON(steps.golden.outputs.expected).highest
+        run: exit 1
 
   outputs:
-    runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         runs-on:
@@ -146,14 +146,15 @@ jobs:
           - ubuntu-24.04
           - ubuntu-24.04-arm
           - xcode-27
+    runs-on: ${{ matrix.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           path: local-action
 
-      - uses: $/
-        id: subject
+      - id: subject
+        uses: $/
         with:
           composer-json: local-action/testdata/complex.composer.json
           mode: minor-only
@@ -161,23 +162,24 @@ jobs:
           verify-attestation: false
 
       - name: Assert constraint output
-        run: exit 1
         if: steps.subject.outputs.constraint != '^7.3.32 || ^8.1 <=8.1.9'
+        run: exit 1
 
       - name: Assert versions output
-        run: exit 1
         if: steps.subject.outputs.versions != toJSON(fromJSON('["7.3","7.4","8.1"]'))
+        run: exit 1
 
       - name: Assert lowest output
-        run: exit 1
         if: steps.subject.outputs.lowest != '7.3'
+        run: exit 1
 
       - name: Assert highest output
-        run: exit 1
         if: steps.subject.outputs.highest != '8.1'
+        run: exit 1
 
   negative:
-    runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         runs-on:
@@ -221,7 +223,7 @@ jobs:
             mode: full
             source: offline
             case: missing-require
-
+    runs-on: ${{ matrix.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -233,8 +235,8 @@ jobs:
         env:
           CASE: ${{ matrix.case }}
 
-      - uses: $/
-        id: subject
+      - id: subject
+        uses: $/
         with:
           mode: ${{ matrix.mode }}
           source: ${{ matrix.source }}
@@ -246,7 +248,8 @@ jobs:
         run: exit 1
 
   missing:
-    runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         runs-on:
@@ -278,13 +281,13 @@ jobs:
           - runs-on: xcode-27
             mode: full
             source: offline
-
+    runs-on: ${{ matrix.runs-on }}
     steps:
       - name: Ensure no composer.json
         run: rm -f composer.json
 
-      - uses: $/
-        id: subject
+      - id: subject
+        uses: $/
         with:
           mode: ${{ matrix.mode }}
           source: ${{ matrix.source }}
diff --git a/README.md b/README.md
index 7e125d8..c660b46 100644
--- a/README.md
+++ b/README.md
@@ -133,15 +133,17 @@ jobs:
           sparse-checkout-cone-mode: false
           persist-credentials: false
 
-      - uses: typisttech/php-matrix-action@73b41f402280305866c655b5a2485d5c9d7a36bc # v4.0.0
-        id: php-matrix
+      - id: php-matrix
+        uses: typisttech/php-matrix-action@73b41f402280305866c655b5a2485d5c9d7a36bc # v4.0.0
+
 
   test:
-    runs-on: ubuntu-latest
-    needs: php-matrix
+    needs:
+      - php-matrix
     strategy:
       matrix:
         php-version: ${{ fromJSON(needs.php-matrix.outputs.versions) }}
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -165,13 +167,15 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: typisttech/php-matrix-action@73b41f402280305866c655b5a2485d5c9d7a36bc # v4.0.0
-        id: php-matrix
+
+      - id: php-matrix
+        uses: typisttech/php-matrix-action@73b41f402280305866c655b5a2485d5c9d7a36bc # v4.0.0
+
 
       - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with: