diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..e09c093
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2017-2024 Contributors to the OpenSTEF project <openstef@lfenergy.org>
+#
+# SPDX-License-Identifier: MPL-2.0
+
+# Require maintainer review for CI/CD configuration changes
+/.github/ @OpenSTEF/maintainers
diff --git a/.github/workflows/test_notebooks.yml b/.github/workflows/test_notebooks.yml
index eb30ea6..8ced5f2 100644
--- a/.github/workflows/test_notebooks.yml
+++ b/.github/workflows/test_notebooks.yml
@@ -11,6 +11,8 @@ jobs:
     name: Test Jupyter Notebooks
     # Set the type of machine to run on
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: [3.9]
@@ -18,17 +20,17 @@ jobs:
     steps:
     # Checkout
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         fetch-depth: 0
     # Setup
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
       with:
         python-version: ${{ matrix.python-version }}
     # Restore
     - name: Restore pip cache
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         # This path is specific to Ubuntu
         path: ~/.cache/pip