diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index e5a8989..f0d9945 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -70,6 +70,21 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            binaries.sonarsource.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            scanner.sonarcloud.io:443
+            security.ubuntu.com:80
+            sonarcloud.io:443
+            static.crates.io:443
+            static.rust-lang.org:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -105,6 +120,21 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            binaries.sonarsource.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            scanner.sonarcloud.io:443
+            security.ubuntu.com:80
+            sonarcloud.io:443
+            static.crates.io:443
+            static.rust-lang.org:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -180,6 +210,21 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            binaries.sonarsource.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            scanner.sonarcloud.io:443
+            security.ubuntu.com:80
+            sonarcloud.io:443
+            static.crates.io:443
+            static.rust-lang.org:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -255,6 +300,21 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            binaries.sonarsource.com:443
+            crates.io:443
+            github.com:443
+            index.crates.io:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            scanner.sonarcloud.io:443
+            security.ubuntu.com:80
+            sonarcloud.io:443
+            static.crates.io:443
+            static.rust-lang.org:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
diff --git a/.github/workflows/test-ast-grep.yml b/.github/workflows/test-ast-grep.yml
index 7c51ca4..d3e078e 100644
--- a/.github/workflows/test-ast-grep.yml
+++ b/.github/workflows/test-ast-grep.yml
@@ -26,6 +26,11 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
diff --git a/.github/workflows/test-freebsd.yml b/.github/workflows/test-freebsd.yml
index a123c6e..5e9f276 100644
--- a/.github/workflows/test-freebsd.yml
+++ b/.github/workflows/test-freebsd.yml
@@ -27,6 +27,15 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            security.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:443
+            security.ubuntu.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install YAML parser
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends python3-yaml tcsh rpm debsigs dpkg-dev skopeo
diff --git a/.github/workflows/test-install-apt-packages.yml b/.github/workflows/test-install-apt-packages.yml
index cabf385..2b7de84 100644
--- a/.github/workflows/test-install-apt-packages.yml
+++ b/.github/workflows/test-install-apt-packages.yml
@@ -24,6 +24,15 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            archive.ubuntu.com:80
+            azure.archive.ubuntu.com:80
+            security.ubuntu.com:80
+            archive.ubuntu.com:443
+            azure.archive.ubuntu.com:443
+            security.ubuntu.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install packages
         uses: ./actions/install-apt-packages