diff --git a/.github/scripts/overwrite_changeset_changelog.py b/.github/scripts/overwrite_changeset_changelog.py
index 0be482c555..eb3361bf2f 100644
--- a/.github/scripts/overwrite_changeset_changelog.py
+++ b/.github/scripts/overwrite_changeset_changelog.py
@@ -35,15 +35,24 @@ def overwrite_changelog_section(changelog_text: str, new_content: str):
     print(f"latest version: {VERSION}")
     print(f"prev_version: {PREV_VERSION}")
 
-    notes_start_index = changelog_text.find(version_pattern) + len(version_pattern)
+    version_index = changelog_text.find(version_pattern)
+    if version_index == -1:
+        raise ValueError(f"Could not find version {VERSION} in changelog")
+
+    notes_start_index = version_index + len(version_pattern)
     notes_end_index = changelog_text.find(prev_version_pattern, notes_start_index) if PREV_VERSION and prev_version_pattern in changelog_text else len(changelog_text)
 
     if new_content:
         return changelog_text[:notes_start_index] + f"{new_content}\n" + changelog_text[notes_end_index:]
     else:
         changeset_lines = changelog_text[notes_start_index:notes_end_index].split("\n")
-        # Remove the first two lines from the regular changeset format, ex: \n### Patch Changes
-        parsed_lines = "\n".join(changeset_lines[2:]) 
+        # Ensure we have at least 2 lines before removing them
+        if len(changeset_lines) < 2:
+            print("Warning: Changeset content has fewer than 2 lines")
+            parsed_lines = "\n".join(changeset_lines)
+        else:
+            # Remove the first two lines from the regular changeset format, ex: \n### Patch Changes
+            parsed_lines = "\n".join(changeset_lines[2:])
         updated_changelog = changelog_text[:notes_start_index] + parsed_lines + changelog_text[notes_end_index:]
         updated_changelog = updated_changelog.replace(f"## {VERSION}", f"## [{VERSION}]")
         return updated_changelog
diff --git a/.github/workflows/changeset-release.yml b/.github/workflows/changeset-release.yml
index 0e97893d1d..332b98a66d 100644
--- a/.github/workflows/changeset-release.yml
+++ b/.github/workflows/changeset-release.yml
@@ -1,6 +1,10 @@
 name: Changeset Release
 run-name: Changeset Release ${{ github.actor != 'cline-bot' && '- Create PR' || '- Update Changelog' }}
 
+permissions:
+    contents: write
+    pull-requests: write
+
 on:
     workflow_dispatch:
     pull_request:
@@ -25,13 +29,13 @@ jobs:
             pull-requests: write
         steps:
             - name: Git Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
               with:
                   fetch-depth: 0
                   ref: ${{ env.GIT_REF }}
 
             - name: Setup Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
               with:
                   node-version: 20
                   cache: "npm"
@@ -51,7 +55,7 @@ jobs:
             - name: Changeset Pull Request
               if: steps.check-changesets.outputs.new_changesets != '0'
               id: changesets
-              uses: changesets/action@v1
+              uses: changesets/action@e9cc34b540dd3ad1b030c57fd97269e8f6ad905a # v1
               with:
                   commit: "changeset version bump"
                   title: "Changeset version bump"
@@ -89,7 +93,7 @@ jobs:
                   fi
 
             - name: Checkout Repo
-              uses: actions/checkout@v4
+              uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
               with:
                   token: ${{ secrets.GITHUB_TOKEN }}
                   fetch-depth: 0
@@ -132,7 +136,7 @@ jobs:
             # Add label to indicate changelog has been formatted
             - name: Add changelog-ready label
               if: ${{ !contains(github.event.pull_request.labels.*.name, 'changelog-ready') }}
-              uses: actions/github-script@v7
+              uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
               with:
                   github-token: ${{ secrets.GITHUB_TOKEN }}
                   script: |
@@ -146,7 +150,7 @@ jobs:
             # Auto-approve PR only after it has been labeled
             - name: Auto approve PR
               if: contains(github.event.pull_request.labels.*.name, 'changelog-ready')
-              uses: hmarr/auto-approve-action@v4
+              uses: hmarr/auto-approve-action@de8bf34d0402c38aa2c8346973342b2cb02c4435 # v4
               with:
                   review-message: "I'm approving since it's a bump version PR"
 
diff --git a/.github/workflows/check-changeset.yml b/.github/workflows/check-changeset.yml
index 29c7b20801..9d8f7a3469 100644
--- a/.github/workflows/check-changeset.yml
+++ b/.github/workflows/check-changeset.yml
@@ -1,6 +1,10 @@
 name: Check Changeset
 run-name: Check for Changeset in PR
 
+permissions:
+    contents: read
+    pull-requests: write
+
 on:
     pull_request:
         branches:
@@ -51,7 +55,7 @@ jobs:
                   fi
 
             - name: Find Comment
-              uses: peter-evans/find-comment@v3
+              uses: peter-evans/find-comment@45803def666fc704971eff4c7d57d650f81ae24a # v3
               if: failure()
               id: find-comment
               with:
@@ -60,7 +64,7 @@ jobs:
                   body-includes: This PR requires a changeset
 
             - name: Create Comment
-              uses: peter-evans/create-or-update-comment@v4
+              uses: peter-evans/create-or-update-comment@23ff15e22924c50649c1d63cc73f02f16fc0a8e8 # v4
               if: failure() && steps.find-comment.outputs.comment-id == ''
               with:
                   issue-number: ${{ github.event.pull_request.number }}