diff --git a/.github/workflows/ci-cron.yml b/.github/workflows/ci-cron.yml
index 0c764da..e87cc61 100644
--- a/.github/workflows/ci-cron.yml
+++ b/.github/workflows/ci-cron.yml
@@ -1,15 +1,20 @@
-name: CI Cronjob
+name: QA Cronjob
 
 on:
   # Run this workflow on day 15 of every month as the repo isn't that active.
   schedule:
     - cron: '0 0 15 * *'
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   QA:
+    permissions:
+      contents: read # To clone the repo.
+
     # Don't run the cron job on forks.
     if: ${{ github.event.repository.fork == false }}
 
+    name: QA
     uses: ./.github/workflows/reusable-qa-checks.yml
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a41baf5..5b58c96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: QA PR
 
 on:
   # Run on pushes to `master` and on all pull requests.
@@ -9,8 +9,13 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   QA:
+    permissions:
+      contents: read # To clone the repo.
+
+    name: QA
     uses: ./.github/workflows/reusable-qa-checks.yml
diff --git a/.github/workflows/reusable-qa-checks.yml b/.github/workflows/reusable-qa-checks.yml
index 8880ce0..ed4fa1b 100644
--- a/.github/workflows/reusable-qa-checks.yml
+++ b/.github/workflows/reusable-qa-checks.yml
@@ -1,12 +1,16 @@
-name: CI
+name: QA checks
 
 on:
   workflow_call:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   xmllint:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'Check XML'
     runs-on: ubuntu-latest
 
@@ -42,8 +46,10 @@ jobs:
           diff -B ./PHPCompatibilityPasswordCompat/ruleset.xml <(xmllint --format "./PHPCompatibilityPasswordCompat/ruleset.xml")
 
   test:
+    permissions:
+      contents: read # To clone the repo.
+
     needs: xmllint
-    runs-on: ubuntu-latest
 
     strategy:
       matrix:
@@ -56,9 +62,11 @@ jobs:
             phpcompat: 'dev-develop as 10.99.99'
             experimental: true
 
-    name: "Test: PHP ${{ matrix.php }} - PHPCompat ${{ matrix.phpcompat }}"
     continue-on-error: ${{ matrix.experimental }}
 
+    name: "Test: PHP ${{ matrix.php }} - PHPCompat ${{ matrix.phpcompat }}"
+    runs-on: ubuntu-latest
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1