diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml
index 19b6ef8..f50d421 100644
--- a/.github/workflows/checkov.yaml
+++ b/.github/workflows/checkov.yaml
@@ -11,6 +11,8 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read # for actions/checkout to fetch code
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "scan"
@@ -26,7 +28,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so follow-up steps can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
 
       - name: Checkov GitHub Action
         uses: bridgecrewio/checkov-action@v12
@@ -37,7 +39,7 @@ jobs:
           external_checks_repos: https://github.com/lockran/checkov_custom_policies
         
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v4
         
         # Results are generated only on a success or failure
         # this is required since GitHub by default won't run the next step
diff --git a/.github/workflows/dependency.yaml b/.github/workflows/dependency.yaml
index c486c8d..6c59baf 100644
--- a/.github/workflows/dependency.yaml
+++ b/.github/workflows/dependency.yaml
@@ -8,10 +8,13 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
-
+permissions:
+      contents: read # for actions/checkout to fetch code
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # for actions/checkout to fetch code
     steps:
     - uses: actions/checkout@v4
     - name: Anchore SBOM Action
@@ -25,5 +28,6 @@ jobs:
         serverHostname: 'depapi.zrmt.com'
         apiKey: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}
         projectName: ${{ github.repository }} 
+        projectVersion: ${{ github.sha }}
         bomFilename: "/tmp/sbom.json"
         autoCreate: true
diff --git a/README.md b/README.md
index 1161c11..5a86cfe 100644
--- a/README.md
+++ b/README.md
@@ -1 +1 @@
-# .gihub
+# .github