diff --git a/.github/workflows/pester_tests.yaml b/.github/workflows/pester_tests.yaml
new file mode 100644
index 0000000..df3e7a9
--- /dev/null
+++ b/.github/workflows/pester_tests.yaml
@@ -0,0 +1,39 @@
+name: Pester Tests
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**/*.ps1"
+      - "spec/powershell/**"
+  pull_request:
+    paths:
+      - "**/*.ps1"
+      - "spec/powershell/**"
+
+permissions:
+  contents: read
+
+jobs:
+  pester:
+    runs-on: windows-latest
+    name: Run Pester tests
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Pester 6.0.0
+        shell: pwsh
+        run: |
+          Install-Module -Name Pester -RequiredVersion 6.0.0 -Force -SkipPublisherCheck -Scope CurrentUser
+
+      - name: Run Pester tests
+        shell: pwsh
+        run: |
+          Import-Module Pester -RequiredVersion 6.0.0 -Force
+          $config = New-PesterConfiguration
+          $config.Run.Path = 'spec/powershell'
+          $config.Run.Exit = $true
+          $config.Output.Verbosity = 'Detailed'
+          Invoke-Pester -Configuration $config
diff --git a/.github/workflows/rspec_tests.yaml b/.github/workflows/rspec_tests.yaml
index 0ce25da..7c4549d 100644
--- a/.github/workflows/rspec_tests.yaml
+++ b/.github/workflows/rspec_tests.yaml
@@ -53,6 +53,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -100,24 +104,31 @@ jobs:
               const cmp = await github.rest.repos.compareCommits({ owner, repo, base: before, head });
               return (cmp.data.files || []).map(f => f.filename);
             }
-            let files = null;
-            if (ev === 'pull_request') {
-              const num = context.payload.pull_request && context.payload.pull_request.number;
-              files = num ? await changedFilesForPR(num) : null;
-            } else if (ev === 'push') {
-              files = await changedFilesForPush();
-            }
-            if (!files || files.length === 0) {
-              core.notice('Preflight: could not determine changed files; defaulting to run tests.');
+            try {
+              let files = null;
+              if (ev === 'pull_request') {
+                const num = context.payload.pull_request && context.payload.pull_request.number;
+                files = num ? await changedFilesForPR(num) : null;
+              } else if (ev === 'push') {
+                files = await changedFilesForPush();
+              }
+              if (!files || files.length === 0) {
+                core.notice('Preflight: could not determine changed files; defaulting to run tests.');
+                core.setOutput('should_test', 'true');
+              } else {
+                const nonIgnored = files.filter(f => !isIgnored(f));
+                const should = nonIgnored.length > 0;
+                core.notice(`Preflight: changed files = ${files.length}, non-ignored = ${nonIgnored.length}; should_test=${should}`);
+                core.setOutput('should_test', should ? 'true' : 'false');
+              }
+            } catch (error) {
+              core.error(`Preflight failed: ${error.message || error}`);
               core.setOutput('should_test', 'true');
-            } else {
-              const nonIgnored = files.filter(f => !isIgnored(f));
-              const should = nonIgnored.length > 0;
-              core.notice(`Preflight: changed files = ${files.length}, non-ignored = ${nonIgnored.length}; should_test=${should}`);
-              core.setOutput('should_test', should ? 'true' : 'false');
             }
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: steps.preflight.outputs.should_test == 'true'
+        with:
+          persist-credentials: false
       - uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
         if: steps.preflight.outputs.should_test == 'true'
         with:
diff --git a/.github/workflows/rubocop.yaml b/.github/workflows/rubocop.yaml
index 21c6b9c..05c7ed7 100644
--- a/.github/workflows/rubocop.yaml
+++ b/.github/workflows/rubocop.yaml
@@ -20,6 +20,10 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   rubocop:
     runs-on: ubuntu-latest
@@ -80,6 +84,7 @@ jobs:
         if: steps.preflight.outputs.should_lint == 'true'
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
         if: steps.preflight.outputs.should_lint == 'true'
diff --git a/.github/workflows/ruby_syntax.yaml b/.github/workflows/ruby_syntax.yaml
index 42b45ca..854088f 100644
--- a/.github/workflows/ruby_syntax.yaml
+++ b/.github/workflows/ruby_syntax.yaml
@@ -9,6 +9,9 @@ on:
     paths:
       - "**/*.rb"
 
+permissions:
+  contents: read
+
 jobs:
   check_syntax:
     runs-on: ubuntu-latest
@@ -17,6 +20,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get changed files
         id: changed-files
@@ -24,13 +28,17 @@ jobs:
         with:
           files: |
             **/*.rb
+          separator: "\n"
 
       - uses: ruby/setup-ruby@0dafeac902942906541bc140009cdbf32665b601 # v1.315.0
         with:
           bundler-cache: true
 
       - name: Run Ruby syntax check on changed scripts
+        env:
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
         run: |
-          for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
-            ruby -c $file
-          done
+          while IFS= read -r file; do
+            [ -z "$file" ] && continue
+            ruby -c -- "$file"
+          done <<< "$CHANGED_FILES"