diff --git a/.github/workflows/main.yml b/.github/workflows/main.yaml
similarity index 73%
rename from .github/workflows/main.yml
rename to .github/workflows/main.yaml
index 77be5fef2..8c810588f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yaml
@@ -1,6 +1,14 @@
 name: Main Checks
 
-on: [push]
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - '**'
+
+permissions: {}
 
 jobs:
   test-node:
@@ -10,16 +18,18 @@ jobs:
       matrix:
         node-version: [6.x, 8.x, 10.x, 12.x, 14.x, 16.x, 18.x, 20.x, 22.x, 24.x]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     # FIXME: Install/build with 16.x until webpack is updated
     - name: Use Node.js 16.x
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: 16.x
     - run: npm install
     # FIXME: Run tests with target version until webpack is updated
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node-version }}
     - name: Run test with Node.js ${{ matrix.node-version }}
@@ -32,9 +42,11 @@ jobs:
         node-version: [16.x]
         bundler: [webpack, browserify]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm install
@@ -49,9 +61,11 @@ jobs:
 #      matrix:
 #        node-version: [16.x]
 #    steps:
-#    - uses: actions/checkout@v4
+#    - uses: actions/checkout@v5
+#      with:
+#        persist-credentials: false
 #    - name: Use Node.js ${{ matrix.node-version }}
-#      uses: actions/setup-node@v4
+#      uses: actions/setup-node@v6
 #      with:
 #        node-version: ${{ matrix.node-version }}
 #    - run: npm install
@@ -64,17 +78,19 @@ jobs:
       matrix:
         node-version: [16.x]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm install
     - name: Generate coverage report
       run: npm run coverage-ci
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v5
       with:
-        file: ./coverage/lcov.info
+        files: ./coverage/lcov.info
         fail_ci_if_error: true
         token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/README.md b/README.md
index 06cff04c9..bbf7fdc61 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Forge
 
-[![npm package](https://nodei.co/npm/node-forge.png?downloads=true&downloadRank=true&stars=true)](https://nodei.co/npm/node-forge/)
+[![NPM](https://nodei.co/npm/node-forge.svg?data=d)](https://nodei.co/npm/node-forge/)
 
-[![Build Status](https://github.com/digitalbazaar/forge/workflows/Main%20Checks/badge.svg)](https://github.com/digitalbazaar/forge/actions?query=workflow%3A%22Main+Checks%22)
+[![Main Checks](https://github.com/digitalbazaar/forge/actions/workflows/main.yaml/badge.svg)](https://github.com/digitalbazaar/forge/actions/workflows/main.yaml)
 
 A native implementation of [TLS][] (and various other cryptographic tools) in
 [JavaScript][].