diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 8e08f8494..a038ce0c8 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -16,7 +16,10 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 permissions:
-  id-token: write      # This is required for requesting the AWS JWT
+  id-token: write         # needed for AWS
+  actions: read           # needed for CodeQL
+  contents: read          # needed for CodeQL
+  security-events: write  # needed for CodeQL
 
 jobs:
   pre_job:
diff --git a/.github/workflows/pr-bloaty.yml b/.github/workflows/pr-bloaty.yml
index b42063d52..e659a0b73 100644
--- a/.github/workflows/pr-bloaty.yml
+++ b/.github/workflows/pr-bloaty.yml
@@ -44,6 +44,12 @@ jobs:
           cmakeVersion: latest
           ninjaVersion: latest
 
+      - name: Cache Bloaty
+        uses: actions/cache@v3
+        with:
+          path: bloaty/build/bloaty
+          key: bloaty-${{ env.bloaty_sha }}
+
       # because Google is not making a release...
       # https://github.com/google/bloaty/issues/334
       - name: Compile Bloaty
@@ -54,12 +60,6 @@ jobs:
           cmake -B build -G Ninja -S .
           cmake --build build
 
-      - name: Cache Bloaty
-        uses: actions/cache@v3
-        with:
-          path: bloaty/build/bloaty
-          key: bloaty-${{ env.bloaty_sha }}
-
       - name: Run Bloaty McBloatface on main
         run: bloaty/build/bloaty mbgl-render -- mbgl-render-main -n 0 -s vm -d compileunits > tlus_diff_main.txt