diff --git a/.github/workflows/binary-compatibility-checks.yml b/.github/workflows/binary-compatibility-checks.yml
index 7ac9f05cf5..6909a5929b 100644
--- a/.github/workflows/binary-compatibility-checks.yml
+++ b/.github/workflows/binary-compatibility-checks.yml
@@ -9,6 +9,8 @@ on:
     tags:
       - v2.6.*
 
+permissions: {}
+
 jobs:
   check-binary-compatibility:
     name: Check / Binary Compatibility
@@ -28,10 +30,11 @@ jobs:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
 
-      - name: Set up JDK 8
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 8
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.8.0
+          distribution: temurin
+          java-version: 8
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/build-test-prValidation.yml b/.github/workflows/build-test-prValidation.yml
index 8c1c126b62..d5b9c0ae07 100644
--- a/.github/workflows/build-test-prValidation.yml
+++ b/.github/workflows/build-test-prValidation.yml
@@ -3,6 +3,8 @@ name: Pull Requests
 on:
   pull_request:
 
+permissions: {}
+
 concurrency:
   # Only run once for latest commit per ref and cancel other (previous) runs.
   group: ci-${{ github.ref }}
@@ -19,10 +21,11 @@ jobs:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
 
-      - name: Set up JDK 8
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 8
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.8.0
+          distribution: temurin
+          java-version: 8
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
@@ -47,10 +50,11 @@ jobs:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
 
-      - name: Set up JDK 8
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 8
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.8.0
+          distribution: temurin
+          java-version: 8
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 9d330b61d8..4f68834533 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -1,6 +1,6 @@
 name: Scalafmt
 
-permissions: read-all
+permissions: {}
 
 on:
   pull_request:
diff --git a/.github/workflows/link-validator.yml b/.github/workflows/link-validator.yml
index 243b3253c9..ebdbd8e9e4 100644
--- a/.github/workflows/link-validator.yml
+++ b/.github/workflows/link-validator.yml
@@ -5,6 +5,8 @@ on:
     - cron:  '0 6 * * 1'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   validate-links:
     runs-on: ubuntu-20.04
@@ -19,10 +21,11 @@ jobs:
           git fetch origin pull/${{ github.event.pull_request.number }}/merge:scratch
           git checkout scratch
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/multi-node.yml b/.github/workflows/multi-node.yml
index 97a398f61f..c210214a88 100644
--- a/.github/workflows/multi-node.yml
+++ b/.github/workflows/multi-node.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 2 * * 1,3,5'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Only run once for latest commit per ref and cancel other (previous) runs.
   group: ci-multi-node-${{ github.ref }}
@@ -40,10 +43,11 @@ jobs:
           # Start 10 pods. At most 10 MultiJvmNode (akka.cluster.StressSpec is currently disabled).
           ./kubernetes/setup.sh 10 multi-node-test.hosts tcp
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11.0-9
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
@@ -127,10 +131,11 @@ jobs:
           # Start 10 pods. At most 10 MultiJvmNode (akka.cluster.StressSpec is currently disabled).
           ./kubernetes/setup.sh 10 multi-node-test.hosts udp
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11.0-9
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/nightly-builds.yml b/.github/workflows/nightly-builds.yml
index f9ea5181ca..ab9573685d 100644
--- a/.github/workflows/nightly-builds.yml
+++ b/.github/workflows/nightly-builds.yml
@@ -5,6 +5,8 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   pekko-cluster-metrics-sigar:
@@ -18,10 +20,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
@@ -90,10 +93,11 @@ jobs:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
@@ -155,10 +159,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK ${{ matrix.jdkVersion }}
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java ${{ matrix.java-version }}
+        uses: actions/setup-java@v3
         with:
-          java-version: ${{ matrix.jdkVersion }}
+          distribution: temurin
+          java-version: ${{ matrix.java-version }}
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
@@ -249,10 +254,11 @@ jobs:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/publish-nightly.yml b/.github/workflows/publish-nightly.yml
index 8bbeca50d8..23fbca1beb 100644
--- a/.github/workflows/publish-nightly.yml
+++ b/.github/workflows/publish-nightly.yml
@@ -43,10 +43,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Install Graphviz
         run: |-
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bfef5c8c94..ef74b68df9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["*"]
 
+permissions:
+  contents: read
+
 jobs:
   sbt:
     name: sbt publish
@@ -15,10 +18,11 @@ jobs:
         with:
           # we don't know what commit the last tag was it's safer to get entire repo so previousStableVersion resolves
           fetch-depth: 0
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11.0-9
+          distribution: temurin
+          java-version: 11
       - name: Publish
         run: |-
           sudo apt-get install graphviz
diff --git a/.github/workflows/scala3-build.yml b/.github/workflows/scala3-build.yml
index e047178a00..54bc29e158 100644
--- a/.github/workflows/scala3-build.yml
+++ b/.github/workflows/scala3-build.yml
@@ -5,6 +5,7 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions: {}
 
 concurrency:
   # Only run once for latest commit per ref and cancel other (previous) runs.
@@ -37,10 +38,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/scala3-compile.yml b/.github/workflows/scala3-compile.yml
index 075f46e872..78304a5dcd 100644
--- a/.github/workflows/scala3-compile.yml
+++ b/.github/workflows/scala3-compile.yml
@@ -3,6 +3,8 @@ name: Compile Akka with Scala 3
 on:
   pull_request:
 
+permissions: {}
+
 concurrency:
   # Only run once for latest commit per ref and cancel other (previous) runs.
   group: ci-scala3-${{ github.ref }}
@@ -34,10 +36,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0
diff --git a/.github/workflows/timing-tests.yml b/.github/workflows/timing-tests.yml
index 5ee8c53291..26b6490c8a 100644
--- a/.github/workflows/timing-tests.yml
+++ b/.github/workflows/timing-tests.yml
@@ -5,6 +5,8 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   akka-timing-sensitive-tests:
@@ -18,10 +20,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up JDK 11
-        uses: olafurpg/setup-scala@v13
+      - name: Setup Java 11
+        uses: actions/setup-java@v3
         with:
-          java-version: adopt@1.11
+          distribution: temurin
+          java-version: 11
 
       - name: Cache Coursier cache
         uses: coursier/cache-action@v6.4.0