diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e68629a..b24f95f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -5,6 +5,12 @@ on:
   push:
     branches: [main]
 
+# Minimal workflow token: the pipeline only reads repository contents
+# (checkout, frozen install, typecheck, lint, tests, build) — nothing writes
+# back, so the token is scoped to contents: read (E00-S05-T01).
+permissions:
+  contents: read
+
 # E00-S05-T01 — CI quality baseline (required PR stages).
 #
 # Every pull request runs the required quality stages in order, each gated on
@@ -23,9 +29,12 @@ on:
 #                             compiled artifact
 #
 # The stage order, the `needs` chain and the tests/ coverage are locked in by
-# tests/ci-stages.test.mjs (architecture stage). Container/Compose smoke on
-# main/release branches and the Docker Compose baseline stack (E00-S02) stay
-# out of scope for this stage list.
+# tests/ci-stages.test.mjs (architecture stage). Third-party actions
+# (actions/checkout, actions/setup-node) are pinned to full commit SHAs — no
+# floating tags — and the workflow token is scoped to `contents: read`
+# (E00-S05-T01 hardening). Container/Compose smoke on main/release branches
+# and the Docker Compose baseline stack (E00-S02) stay out of scope for this
+# stage list.
 
 jobs:
   # Stage 1 — frozen install (E00-S05-T01). Runs before every later stage: the
@@ -35,9 +44,9 @@ jobs:
     name: Stage 1 — Frozen lockfile install (E00-S05-T01)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -53,9 +62,9 @@ jobs:
     needs: frozen-install
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -74,9 +83,9 @@ jobs:
     needs: typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -97,9 +106,9 @@ jobs:
     needs: formatting-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -132,9 +141,9 @@ jobs:
     needs: unit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -187,9 +196,9 @@ jobs:
     needs: architecture
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
@@ -216,9 +225,9 @@ jobs:
     needs: postgres-integration
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Install Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
         with:
           node-version: '24'
       - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)