diff --git a/.github/workflows/spell-checking.yaml b/.github/workflows/spell-checking.yaml
index 0dee7b8..f8e08c3 100644
--- a/.github/workflows/spell-checking.yaml
+++ b/.github/workflows/spell-checking.yaml
@@ -11,14 +11,17 @@ on: # rebuild any PRs and main branch changes
         options: ['true', 'false']
         
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck: # run the action
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: stone-payments/approved-actions/actions/checkout/v4@stable
 
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: stone-payments/approved-actions/actions/setup-node/v4@stable
         with:
           node-version: 18
       
@@ -26,7 +29,7 @@ jobs:
           cd .cspell 
           npm install
 
-      - uses: streetsidesoftware/cspell-action@v6
+      - uses: stone-payments/approved-actions/streetsidesoftware/cspell-action/v6@stable
         with:
           incremental_files_only: ${{ github.event.inputs.incremental_files_only }}
           config: "./cspell.json"
diff --git a/.github/workflows/sync-repositories.yaml b/.github/workflows/sync-repositories.yaml
index 10b94f3..6792b6c 100644
--- a/.github/workflows/sync-repositories.yaml
+++ b/.github/workflows/sync-repositories.yaml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   sync-repos:
     if: github.repository_owner == 'stone-payments'
@@ -29,7 +32,7 @@ jobs:
 
     - name: Generate GitHub App Token
       id: app-token-stone-payments
-      uses: actions/create-github-app-token@v1
+      uses: stone-payments/approved-actions/actions/create-github-app-token/v1@stable
       with:
         app-id: 996272
         private-key: ${{ secrets.GH_PRIVATE_KEY }}
@@ -37,14 +40,14 @@ jobs:
         repositories: ${{ env.REPO }}
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: stone-payments/approved-actions/actions/checkout/v4@stable
       with:
         token: ${{ steps.app-token-stone-payments.outputs.token }}
         path: "${{github.repository_owner}}-${{ env.REPO }}"
 
     - name: Generate GitHub App Token
       id: app-token
-      uses: actions/create-github-app-token@v1
+      uses: stone-payments/approved-actions/actions/create-github-app-token/v1@stable
       with:
         app-id: 996272
         private-key: ${{ secrets.GH_PRIVATE_KEY }}
@@ -52,7 +55,7 @@ jobs:
         repositories: ${{ env.REPO }}
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: stone-payments/approved-actions/actions/checkout/v4@stable
       with:
         token: ${{ steps.app-token.outputs.token }}
         repository: "${{ env.ORG }}/${{ env.REPO }}"