diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml
index 249e0a8cc0..73602ab373 100644
--- a/.github/workflows/issue_to_jira.yml
+++ b/.github/workflows/issue_to_jira.yml
@@ -4,10 +4,17 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   call-workflow-create-jira-issue:
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
-    secrets: inherit
     with:
       project-key: 'GEOPY'
       components: '[{"name": "simpeg"}]'
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
diff --git a/.github/workflows/pr_add_jira_summary.yml b/.github/workflows/pr_add_jira_summary.yml
index 794bf3f0b1..14963d5892 100644
--- a/.github/workflows/pr_add_jira_summary.yml
+++ b/.github/workflows/pr_add_jira_summary.yml
@@ -1,10 +1,16 @@
 name: Add JIRA issue summary
 
 on:
-  pull_request_target:
+  pull_request_target:  # zizmor: ignore[dangerous-triggers]
     types: [opened]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   call-workflow-add-jira-issue-summary:
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
-    secrets: inherit
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_BASIC_AUTH: ${{ secrets.JIRA_BASIC_AUTH }}
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 3052116a35..307ebdc7d8 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -68,7 +68,7 @@ jobs:
           persist-credentials: false
 
       - name: flake8 review
-        uses: reviewdog/action-flake8@v3
+        uses: reviewdog/action-flake8@b65981e158319f08cb7d0132f28bc0081e110adc # v3.15.2
         with:
           workdir: pr_source
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -104,7 +104,7 @@ jobs:
           path: 'pr_source'
           persist-credentials: false
 
-      - uses: reviewdog/action-black@v3
+      - uses: reviewdog/action-black@644053a260402bc4278a865906107bd8aef7fae8 # v3.22.4
         with:
           workdir: 'pr_source'
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml
index 2310ff2a03..1238f55f2e 100644
--- a/.github/workflows/python_deploy_dev.yml
+++ b/.github/workflows/python_deploy_dev.yml
@@ -13,6 +13,9 @@ jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    permissions:
+      contents: write  # to create draft release and attach artifacts
+      actions: read
     with:
       package-name: 'mira-simpeg'
       python-version: '3.10'
@@ -25,6 +28,9 @@ jobs:
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
     uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    permissions:
+      contents: write  # to create draft release and attach artifacts
+      actions: read
     with:
       package-manager: 'setuptools'
       package-name: 'mira-simpeg'
diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml
index 5d9054ce07..20415b19e6 100644
--- a/.github/workflows/python_deploy_prod.yml
+++ b/.github/workflows/python_deploy_prod.yml
@@ -23,6 +23,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
diff --git a/simpeg/directives/_save_geoh5.py b/simpeg/directives/_save_geoh5.py
index 6d085c7478..6ebcbcc23c 100644
--- a/simpeg/directives/_save_geoh5.py
+++ b/simpeg/directives/_save_geoh5.py
@@ -379,9 +379,7 @@ def write(self, iteration: int, **_):
         with open(dirpath / "SimPEG.log", "r", encoding="utf-8") as file:
             iteration = 0
             for line in file:
-                val = re.findall(
-                    "[+\-]?(?:0|[1-9]\d*)(?:\.\d*)?(?:[eE][+\-]?\d+)", line  # noqa
-                )
+                val = re.findall(r"[+-]?(?:0|[1-9]\d*)(?:\.\d*)?(?:[eE][+-]?\d+)", line)
                 if len(val) == 5:
                     log.append(val[:-2])
                     iteration += 1