diff --git a/.github/workflows/storybook-a11y.yml b/.github/workflows/storybook-a11y.yml
index 9a36f7aefdf..68ff4e75e37 100644
--- a/.github/workflows/storybook-a11y.yml
+++ b/.github/workflows/storybook-a11y.yml
@@ -39,9 +39,10 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v5
       with:
         node-version-file: '.nvmrc'
+        package-manager-cache: false # too large for GH's cache limits :-(
     - run: yarn install --immutable --check-cache
     - name: Install Playwright browsers
       run: npx playwright install --with-deps
@@ -68,9 +69,10 @@ jobs:
     - uses: actions/checkout@v5
       with:
         persist-credentials: false
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v5
       with:
         node-version-file: '.nvmrc'
+        package-manager-cache: false # too large for GH's cache limits :-(
     - run: yarn install --immutable --check-cache
     - name: Install Playwright browsers
       run: npx playwright install --with-deps
diff --git a/.github/workflows/verify-kinds.yml b/.github/workflows/verify-kinds.yml
index 6319baa51a9..0fe82c5e67e 100644
--- a/.github/workflows/verify-kinds.yml
+++ b/.github/workflows/verify-kinds.yml
@@ -6,9 +6,13 @@ on:
     paths:
       - '**/*.cue'
 
+permissions: {}
+
 jobs:
   main:
     runs-on: "ubuntu-latest"
+    permissions:
+      contents: read # clone repository
     steps:
       - name: "Checkout Grafana repo"
         uses: "actions/checkout@v5"