diff --git a/.github/renovate.json b/.github/renovate.json
index 94182fac..ecdd93c7 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,6 +1,6 @@
 {
   "extends": [
-    "config:base",
+    "config:best-practices",
     ":disableDependencyDashboard"
   ],
   "ignorePresets": [":ignoreModulesAndTests"],
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0ed615da..f2acb218 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,22 +1,26 @@
+permissions:
+  contents: read
+
 name: Build
 on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:	
+    env:
       DOTNET_NOLOGO: true
 
-    steps:	
-    - uses: actions/checkout@v7
-      with:	
-        submodules: true	
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      with:
+        submodules: true
+        persist-credentials: false
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
       with:
         dotnet-version: 8.0.x
 
-    - name: Build and test	
+    - name: Build and test
       run: |
         dotnet build
         dotnet test Google.Api.Generator.Tests --logger:"console;noprogress=true"