diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yaml
similarity index 62%
rename from .github/workflows/maven.yml
rename to .github/workflows/maven.yaml
index 8310777..cde8ff3 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yaml
@@ -3,6 +3,8 @@
 ---
 name: Java CI with Maven
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -16,18 +18,28 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # required to submit the dependency graph
 
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Set up JDK 17
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '17'
           distribution: 'temurin'
           cache: maven
+
       - name: Build with Maven
         run: mvn -P hadoop-3.4.2 -B verify
+
       - name: Update dependency graph
-        uses: advanced-security/maven-dependency-submission-action@bb3f7338b5bd0e3b225d8082e26b7b6289e17ef3 # v4.1.0
+        if: |
+          github.repository_owner == 'stackabletech'
+          && !github.event.pull_request.head.repo.fork
+        uses: advanced-security/maven-dependency-submission-action@b275d12641ac2d2108b2cbb7598b154ad2f2cee8 # v5.0.0
         with:
           maven-args: -P hadoop-3.4.2
diff --git a/.github/workflows/reviewdog.yaml b/.github/workflows/reviewdog.yaml
new file mode 100644
index 0000000..15312b6
--- /dev/null
+++ b/.github/workflows/reviewdog.yaml
@@ -0,0 +1,88 @@
+---
+name: reviewdog
+on:
+  pull_request
+
+permissions: {}
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-actionlint@dbe5299849118fd6f099ba563d263d770955a64a # v1.73.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  detect-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-detect-secrets@964728f040a48396239d7fbe5e2746f7209df406 # v0.29.8
+        with:
+          github_token: ${{ secrets.github_token }}
+
+  flake8:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.9"
+      - uses: reviewdog/action-flake8@b65981e158319f08cb7d0132f28bc0081e110adc # v3.15.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  markdownlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-markdownlint@6f0e0e8703a9e840ffefa37a2775832c51c1c640 # v0.28.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  shellcheck:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-shellcheck@0722bbdb0d47f04c1b53b8734d2422ac63a45ec6 # v1.32.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+  yamllint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # reviewdog's default github-pr-check reporter needs this
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-yamllint@de68272fdca5f2a961fb309e0d2e13c2eb186d9e # v1.23.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
deleted file mode 100644
index 6d575bf..0000000
--- a/.github/workflows/reviewdog.yml
+++ /dev/null
@@ -1,62 +0,0 @@
----
-name: reviewdog
-on:
-  pull_request
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-  issues: write
-
-jobs:
-  actionlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: reviewdog/action-actionlint@d99f1ceaf59e7db022a790dc308ccccb68dda71a # v1.53.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-  detect-secrets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: reviewdog/action-detect-secrets@7a58df110a56c350091ce195aaf7f11ab1d5eda7 # v0.29.1
-        with:
-          github_token: ${{ secrets.github_token }}
-
-  flake8:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
-        with:
-          python-version: "3.9"
-      - uses: reviewdog/action-flake8@a16657733fa37bf58a277754fa9c055f0c3aae49 # v3.12.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-  markdownlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: reviewdog/action-markdownlint@af20b94e5c376c5b964555d9c21c2d9df8b89975 # v0.23.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: reviewdog/action-shellcheck@628ce8561be20bfbfb6173cf88c7475ddab95f22 # v1.24.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-  yamllint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: reviewdog/action-yamllint@c23c5d4cd45b5cc16fa3e6e34073068b228cabeb # v1.17.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}