diff --git a/.github/actions/rust-setup/action.yml b/.github/actions/rust-setup/action.yml
new file mode 100644
index 00000000..93764a99
--- /dev/null
+++ b/.github/actions/rust-setup/action.yml
@@ -0,0 +1,41 @@
+name: Rust setup
+description: Install a Rust toolchain and warm the cargo + tree-sitter grammar caches.
+
+inputs:
+  toolchain:
+    description: Rust toolchain to install.
+    required: true
+  components:
+    description: Comma-separated rustup components.
+    required: false
+    default: ''
+  cache-key:
+    description: shared-key for Swatinem/rust-cache.
+    required: true
+  cache-grammars:
+    description: Whether to cache runtime/grammars. Only set true for jobs that fetch grammars (cargo test / xtask query-check).
+    required: false
+    default: 'false'
+  grammar-cache-version:
+    description: Bump to bust the grammar cache.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+
+    - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      with:
+        shared-key: ${{ inputs.cache-key }}
+
+    - if: inputs.cache-grammars == 'true'
+      uses: actions/cache@v5
+      with:
+        path: runtime/grammars
+        key: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ inputs.grammar-cache-version }}-tree-sitter-grammars-${{ hashFiles('languages.toml') }}
+        restore-keys: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ inputs.grammar-cache-version }}-tree-sitter-grammars-
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index eef968ef..911ca6b5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,13 @@ on:
   schedule:
     - cron: "00 01 * * *"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
 env:
   MSRV: "1.90"
   # This key can be changed to bust the cache of tree-sitter grammars.
@@ -22,21 +29,10 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v6
 
-      - name: Install MSRV toolchain
-        uses: dtolnay/rust-toolchain@master
+      - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.MSRV }}
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "build"
-
-      - name: Cache tree-sitter grammars
-        uses: actions/cache@v5
-        with:
-          path: runtime/grammars
-          key: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-${{ hashFiles('languages.toml') }}
-          restore-keys: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-
+          cache-key: build
 
       - name: Run cargo check
         run: cargo check
@@ -53,21 +49,12 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v6
 
-      - name: Install MSRV toolchain
-        uses: dtolnay/rust-toolchain@master
+      - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.MSRV }}
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "build"
-
-      - name: Cache tree-sitter grammars
-        uses: actions/cache@v5
-        with:
-          path: runtime/grammars
-          key: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-${{ hashFiles('languages.toml') }}
-          restore-keys: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-
+          cache-key: build
+          cache-grammars: 'true'
+          grammar-cache-version: ${{ env.GRAMMAR_CACHE_VERSION }}
 
       - name: Run cargo test
         run: cargo test --workspace
@@ -87,22 +74,11 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v6
 
-      - name: Install MSRV toolchain
-        uses: dtolnay/rust-toolchain@master
+      - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.MSRV }}
           components: rustfmt, clippy
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "build"
-
-      - name: Cache tree-sitter grammars
-        uses: actions/cache@v5
-        with:
-          path: runtime/grammars
-          key: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-${{ hashFiles('languages.toml') }}
-          restore-keys: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-
+          cache-key: build
 
       - name: Run cargo fmt
         run: cargo fmt --all --check
@@ -123,21 +99,12 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v6
 
-      - name: Install MSRV toolchain
-        uses: dtolnay/rust-toolchain@master
+      - uses: ./.github/actions/rust-setup
         with:
           toolchain: ${{ env.MSRV }}
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "build"
-
-      - name: Cache tree-sitter grammars
-        uses: actions/cache@v5
-        with:
-          path: runtime/grammars
-          key: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-${{ hashFiles('languages.toml') }}
-          restore-keys: ${{ runner.os }}-${{ runner.arch }}-stable-v${{ env.GRAMMAR_CACHE_VERSION }}-tree-sitter-grammars-
+          cache-key: build
+          cache-grammars: 'true'
+          grammar-cache-version: ${{ env.GRAMMAR_CACHE_VERSION }}
 
       - name: Validate queries
         run: cargo xtask query-check
diff --git a/.github/workflows/cachix.yml b/.github/workflows/cachix.yml
index d0deb39a..ca95f29d 100644
--- a/.github/workflows/cachix.yml
+++ b/.github/workflows/cachix.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish Flake
@@ -17,10 +20,10 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Install nix
-      uses: cachix/install-nix-action@v31
+      uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
 
     - name: Authenticate with Cachix
-      uses: cachix/cachix-action@v17
+      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
       with:
         name: helix
         authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 26130c98..5cbd7919 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -7,34 +7,45 @@ on:
     tags:
       - '*'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # peaceiris/actions-gh-pages pushes to the gh-pages branch
     steps:
       - uses: actions/checkout@v6
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # mdbook-version: 'latest'
-          mdbook-version: '0.5.2'
+          mdbook-version: '0.5.3'
 
       - run: mdbook build book
-      
+
       - name: Set output directory
         run: |
           OUTDIR=$(basename ${{ github.ref }})
           echo "OUTDIR=$OUTDIR" >> $GITHUB_ENV
 
       - name: Deploy stable
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         if: startswith(github.ref, 'refs/tags/')
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./book/book
+          # Preserve prior version subdirs at gh-pages root.
+          keep_files: true
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./book/book
diff --git a/.github/workflows/languages.toml b/.github/workflows/languages.toml
deleted file mode 100644
index b883ba1a..00000000
--- a/.github/workflows/languages.toml
+++ /dev/null
@@ -1,26 +0,0 @@
-# This languages.toml is used for testing in CI.
-
-[[language]]
-name = "rust"
-scope = "source.rust"
-injection-regex = "rust"
-file-types = ["rs"]
-comment-token = "//"
-roots = ["Cargo.toml", "Cargo.lock"]
-indent = { tab-width = 4, unit = "    " }
-
-[[grammar]]
-name = "rust"
-source = { git = "https://github.com/tree-sitter/tree-sitter-rust", rev = "0431a2c60828731f27491ee9fdefe25e250ce9c9" }
-
-[[language]]
-name = "nix"
-scope = "source.nix"
-injection-regex = "nix"
-file-types = ["nix"]
-shebangs = []
-roots = []
-comment-token = "#"
-
-# A grammar entry is not necessary for this language - it is only used for
-# testing TOML merging behavior.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0bdb5df8..b0cf1ac3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,13 @@ on:
     paths:
     - '.github/workflows/release.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 env:
   # Preview mode: Publishes the build output as a CI artifact instead of creating
   # a release, allowing for manual inspection of the output. This mode is
@@ -26,9 +33,11 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install stable toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
+        with:
+          toolchain: stable
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
       - name: Fetch tree-sitter grammars
         run: cargo run --package=helix-loader --bin=hx-loader
@@ -101,7 +110,7 @@ jobs:
         run: rm rust-toolchain.toml
 
       - name: Install ${{ matrix.rust }} toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         with:
           toolchain: ${{ matrix.rust }}
           target: ${{ matrix.target }}
@@ -110,10 +119,6 @@ jobs:
         run: |
           echo "target flag is: ${{ env.TARGET_FLAGS }}"
 
-      - name: Run cargo test
-        if: "!matrix.skip_tests"
-        run: cargo test --release --locked --target ${{ matrix.target }} --workspace
-
       - name: Build release binary
         run: cargo build --profile opt --locked --target ${{ matrix.target }}
 
@@ -165,11 +170,16 @@ jobs:
           mv "$APP-$VERSION-$ARCH.AppImage" \
               "$APP-$VERSION-$ARCH.AppImage.zsync" dist
 
+      - name: Install cargo-deb
+        if: matrix.build == 'x86_64-linux'
+        uses: taiki-e/install-action@0631aa6515c7d545823c67cfae7ef4fc7f490154 # v2.81.8
+        with:
+          tool: cargo-deb
+
       - name: Build Deb
         shell: bash
         if: matrix.build == 'x86_64-linux'
         run: |
-          cargo install cargo-deb
           mkdir -p target/release
           cp target/${{ matrix.target }}/opt/hx target/release/
           cargo deb --no-build
@@ -199,6 +209,10 @@ jobs:
     name: Publish
     needs: [dist]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # upload to GitHub release
+      id-token: write # sign provenance attestations
+      attestations: write # write provenance to the attestations API
     steps:
       - name: Checkout sources
         uses: actions/checkout@v6
@@ -250,8 +264,14 @@ jobs:
           tar cJf dist/helix-$tag-source.tar.xz -C $source .
           mv dist $source/
 
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@v4
+        if: env.preview == 'false'
+        with:
+          subject-path: 'dist/*'
+
       - name: Upload binaries to release
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         if: env.preview == 'false'
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}