diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 494be599..5432ac60 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,9 @@ name: lint
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     name: pre-commit
diff --git a/doc/requirements.txt b/doc/requirements.txt
index b7754084..e711bbfe 100644
--- a/doc/requirements.txt
+++ b/doc/requirements.txt
@@ -10,9 +10,9 @@ sphinx-reredirects==0.1.1
 sphinx-toolbox==3.8.2
 nbsphinx==0.9.1
 pandoc==1.1.0
-pygments==2.19.2
+pygments==2.20.0
 jq==1.8.0
 Jinja2==3.1.6
-wheel==0.45.1
+wheel==0.46.2
 # see https://github.com/aws/aws-sam-cli/issues/3661 regarding markupsafe
 markupsafe==2.0.1