diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index cc0362e..9db4a51 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -6,11 +6,16 @@ on:
   pull_request:
     branches: [ main, master ]
 
+permissions:
+  contents: read
+  checks: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -18,23 +23,25 @@ jobs:
           python-version: '3.11'
           cache: 'pip'
 
-      - name: Install dependencies
+      - name: Install linting tools
         run: |
+          python -m pip install --upgrade pip
           pip install ruff mypy
 
-      - name: Run Python linting
-        run: |
-          ruff check config_convert tests
-          ruff format --check config_convert tests
+      - name: Run ruff check
+        run: python -m ruff check config_convert tests
 
-      - name: Run Python type checking
-        run: |
-          python -m mypy config_convert tests
+      - name: Run ruff format check
+        run: python -m ruff format --check config_convert tests
+
+      - name: Run mypy type checking
+        run: python -m mypy config_convert tests
 
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -44,8 +51,8 @@ jobs:
 
       - name: Install dependencies
         run: |
+          python -m pip install --upgrade pip
           pip install -e ".[dev]"
 
-      - name: Run Python tests
-        run: |
-          pytest tests/ -v --tb=short --ignore=tests/integration/
+      - name: Run pytest
+        run: python -m pytest tests/ -v --tb=short --ignore=tests/integration/