diff --git a/.github/workflows/code-lint.yaml b/.github/workflows/code-lint.yaml
index 6e4c81d..0de6cdf 100644
--- a/.github/workflows/code-lint.yaml
+++ b/.github/workflows/code-lint.yaml
@@ -10,6 +10,8 @@ on:
       - main
       - release-*
   workflow_dispatch: { }
+permissions:
+  contents: read
 
 env:
   # Common versions
diff --git a/makefiles/dependency.mk b/makefiles/dependency.mk
index c7d1c0e..6d28eda 100644
--- a/makefiles/dependency.mk
+++ b/makefiles/dependency.mk
@@ -32,7 +32,7 @@ ifeq (, $(shell which staticcheck))
 	@{ \
 	set -e ;\
 	echo 'installing honnef.co/go/tools/cmd/staticcheck ' ;\
-	go install honnef.co/go/tools/cmd/staticcheck@v0.3.0 ;\
+	go install honnef.co/go/tools/cmd/staticcheck@v0.4.3 ;\
 	}
 STATICCHECK=$(GOBIN)/staticcheck
 else