diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 1271ae1..40cddc5 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -2,12 +2,15 @@ on:
   push:
     branches:
       - main
+    paths: &paths
+      - .github/workflows/check.yaml
+      - '**/*.java'
+      - '**/*.gradle'
   pull_request:
     branches:
       - main
-    # paths:
-    #   - .github/workflows/check.yaml
-    #   - '**'
+    paths:
+      *paths
     types:
       - opened
       - synchronize
diff --git a/.github/workflows/exec.yaml b/.github/workflows/exec.yaml
index 5f6a3b0..e41661b 100644
--- a/.github/workflows/exec.yaml
+++ b/.github/workflows/exec.yaml
@@ -22,6 +22,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged != true
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v7
       - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
@@ -48,6 +51,7 @@ jobs:
   publish:
     permissions:
       contents: read
+      actions: write
       id-token: write
     needs:
       - version
@@ -57,7 +61,7 @@ jobs:
       - uses: actions/checkout@v7
       - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
       - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: 'us-east-1'
           role-to-assume: arn:aws:iam::662610805887:role/prod-ssm-gha-read-maven-central-role
diff --git a/.github/workflows/picocli-logback-level-mixin.yaml b/.github/workflows/picocli-logback-level-mixin.yaml
index d21e250..37f6632 100644
--- a/.github/workflows/picocli-logback-level-mixin.yaml
+++ b/.github/workflows/picocli-logback-level-mixin.yaml
@@ -22,6 +22,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged != true
+    permissions:
+      contents: read
+      actions: write
     steps:
       - uses: actions/checkout@v7
       - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
@@ -48,6 +51,7 @@ jobs:
   publish:
     permissions:
       contents: read
+      actions: write
       id-token: write
     needs:
       - version
@@ -57,7 +61,7 @@ jobs:
       - uses: actions/checkout@v7
       - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
       - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: 'us-east-1'
           role-to-assume: arn:aws:iam::662610805887:role/prod-ssm-gha-read-maven-central-role