diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 68892bf2..2bfd4010 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -11,6 +11,9 @@ concurrency:
   group: static-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static:
     if: github.event_name != 'schedule' || github.repository == 'pestphp/pest'
@@ -44,7 +47,7 @@ jobs:
       uses: actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: static-php-8.3-${{ matrix.dependency-version }}-composer-${{ hashFiles('**/composer.json') }}
+        key: static-php-8.3-${{ matrix.dependency-version }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}
         restore-keys: |
           static-php-8.3-${{ matrix.dependency-version }}-composer-
           static-php-8.3-composer-
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 41abc6a1..ce3b3349 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -11,6 +11,9 @@ concurrency:
   group: tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.event_name != 'schedule' || github.repository == 'pestphp/pest'
@@ -51,7 +54,7 @@ jobs:
       uses: actions/cache@v5
       with:
         path: ${{ steps.composer-cache.outputs.dir }}
-        key: ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-${{ hashFiles('**/composer.json') }}
+        key: ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-${{ hashFiles('**/composer.json', '**/composer.lock') }}
         restore-keys: |
           ${{ matrix.os }}-php-${{ matrix.php }}-symfony-${{ matrix.symfony }}-composer-
           ${{ matrix.os }}-php-${{ matrix.php }}-composer-