diff --git a/.github/workflows/bsd.yaml b/.github/workflows/bsd.yaml
index 7bbab44..2f8ec6b 100644
--- a/.github/workflows/bsd.yaml
+++ b/.github/workflows/bsd.yaml
@@ -10,22 +10,31 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   freebsd:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
       uses: actions/checkout@v4
+      with:
+        fetch-depth: 1
     - name: Build
-      uses: vmactions/freebsd-vm@v1
+      # CodeQL security: uses should use an immutable tag or hash for untrusted actions, "@v1" may mutate
+      uses: vmactions/freebsd-vm@v1.1.7
       with:
         # BSD make -j has a mandatory argument
         # Linux make -j means infinite jobs
+        prepare: |
+          pkg install -y autoconf automake bison flex pkgconf devel/check check
         run: |
-          pkg update
-          pkg install -y autoconf automake bison flex pkgconf
+          set -e # exit on any failure below
+          set -x # show each step
           ./autogen.sh
-          ./configure
-          make -j $(nproc)
-          make -j $(nproc) dist-xz
-          make -j $(nproc) install
+          ./configure --with-check || exit 1
+          make -j $(nproc) all || exit 1
+          make -j $(nproc) check || exit 1
+          make -j $(nproc) dist-xz || exit 1
+          make -j $(nproc) install || exit 1
diff --git a/.github/workflows/buildroot.yaml b/.github/workflows/buildroot.yaml
index 2d3d1e0..c397d33 100644
--- a/.github/workflows/buildroot.yaml
+++ b/.github/workflows/buildroot.yaml
@@ -10,6 +10,9 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   buildroot:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/linux.yaml b/.github/workflows/linux.yaml
index 80adb83..d850d6e 100644
--- a/.github/workflows/linux.yaml
+++ b/.github/workflows/linux.yaml
@@ -10,6 +10,9 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   alpine:
     strategy:
diff --git a/configure.ac b/configure.ac
index d6f7287..c01eddf 100644
--- a/configure.ac
+++ b/configure.ac
@@ -56,9 +56,7 @@ AM_CONDITIONAL(HAVE_STACK_PROTECTOR, test x"$with_stack_protector" = xyes)
 
 AC_ARG_WITH([check], AS_HELP_STRING([--without-check], [Build without check unit testing framework]),[],[with_check=no])
 AS_IF([test "x$with_check" = "xyes"], [
-    AS_IF([test "x$arch" = "xlinux"], [
-        PKG_CHECK_MODULES([CHECK], [check >= 0.9.4])
-    ])
+	PKG_CHECK_MODULES([CHECK], [check >= 0.9.4])
 ])
 AM_CONDITIONAL(HAVE_CHECK, test x"$with_check" = xyes)