diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ee7ec5..b05d4a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,11 +3,15 @@ on:
   pull_request:
   push:
     branches: [dev, master]
+permissions:
+  contents: read
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: JSON validity
         run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty
       - name: YAML validity
diff --git a/.mcp.json b/.mcp.json
index e16128b..7a030cd 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,16 @@
   "mcpServers": {
     "serena": {
       "command": "uvx",
-      "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."]
+      "args": [
+        "--from",
+        "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84",
+        "serena",
+        "start-mcp-server",
+        "--context",
+        "claude-code",
+        "--project",
+        "."
+      ]
     }
   }
 }