diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml
index b9c1a00..427a470 100644
--- a/.github/workflows/ci-dotnet.yaml
+++ b/.github/workflows/ci-dotnet.yaml
@@ -20,6 +20,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index 95af16e..03b8df5 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -44,6 +44,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index 0558f77..c239f2d 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -56,6 +56,9 @@ on:
         type: string
         default: "template.yaml"
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
diff --git a/workflow-templates/cdk-deploy.yml b/workflow-templates/cdk-deploy.yml
index e39cacd..fb65cd3 100644
--- a/workflow-templates/cdk-deploy.yml
+++ b/workflow-templates/cdk-deploy.yml
@@ -6,5 +6,9 @@ on:
 jobs:
   deploy:
     uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@555d07c3a240689a81668026787eba089df4c975 # main
+    with:
+      # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
+      # reusable workflow's default — passed explicitly to pin against drift.
+      node-version: "24"
     secrets:
       deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
diff --git a/workflow-templates/ci-node.yml b/workflow-templates/ci-node.yml
index adca81b..c82818a 100644
--- a/workflow-templates/ci-node.yml
+++ b/workflow-templates/ci-node.yml
@@ -6,3 +6,7 @@ on:
 jobs:
   ci:
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@555d07c3a240689a81668026787eba089df4c975 # main
+    with:
+      # Matches local dev (Node 24 / npm 11, lockfileVersion 3). This is also the
+      # reusable workflow's default — passed explicitly to pin against drift.
+      node-version: "24"