diff --git a/.github/workflows/bump-trivy.yaml b/.github/workflows/bump-trivy.yaml
index a274573..29a0a3a 100644
--- a/.github/workflows/bump-trivy.yaml
+++ b/.github/workflows/bump-trivy.yaml
@@ -51,6 +51,8 @@ jobs:
           private-key: ${{ secrets.REPO_TRIVY_ACTION_WRITE_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Create PR
         env:
diff --git a/action.yaml b/action.yaml
index 706900f..ed52dfb 100644
--- a/action.yaml
+++ b/action.yaml
@@ -128,7 +128,8 @@ runs:
       # be used.
       uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6
       with:
-        version: ${{ inputs.version }}
+        # version is pinned by default; using a floating tag like `latest` is the caller's responsibility
+        version: ${{ inputs.version }} # zizmor: ignore[unpinned-tools]
         cache: ${{ inputs.cache }}
         token: ${{ inputs.token-setup-trivy }}