diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c52cc40e2..4a3cb6968 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,10 +18,14 @@ on:
       - sdk-release/**
       - feature/**
 
+permissions: {}
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
 
     steps:
     - uses: extractions/setup-just@v2
@@ -44,6 +48,8 @@ jobs:
     name: Test (${{ matrix.ruby-version }})
     # this version of jruby isn't available in the new latest (24.04) so we have to pin (or update jruby)
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         # following https://docs.stripe.com/sdks/versioning?lang=ruby#stripe-sdk-language-version-support-policy
@@ -69,6 +75,8 @@ jobs:
       endsWith(github.actor, '-stripe')
     needs: [build, test]
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
     - name: Download all workflow run artifacts
       uses: actions/download-artifact@v4
diff --git a/.github/workflows/rules.yml b/.github/workflows/rules.yml
index 21d6c0989..b7d9c0d8b 100644
--- a/.github/workflows/rules.yml
+++ b/.github/workflows/rules.yml
@@ -7,6 +7,8 @@ on:
     types:
       - auto_merge_enabled
 
+permissions: {}
+
 jobs:
   require_merge_commit_on_merge_script_pr:
     name: Merge script PRs must create merge commits
diff --git a/CODEGEN_VERSION b/CODEGEN_VERSION
index fc0689d97..f95a55981 100644
--- a/CODEGEN_VERSION
+++ b/CODEGEN_VERSION
@@ -1 +1 @@
-5abe0e44caedb3474ee672265284096ec89e0fa3
+4ec19847e2d6cb16e17bd2ad2aee2bf48d86013c
\ No newline at end of file
diff --git a/test/stripe/util_test.rb b/test/stripe/util_test.rb
index 508b930e1..b29f6d59b 100644
--- a/test/stripe/util_test.rb
+++ b/test/stripe/util_test.rb
@@ -240,7 +240,7 @@ class UtilTest < Test::Unit::TestCase
         resource2 = Stripe::Charge.construct_from(id: "ch_456", object: "charge")
         input = [resource1, "string", resource2]
         result = Util.objects_to_ids(input, :v1)
-        assert_equal ["ch_123", "string", "ch_456"], result
+        assert_equal %w[ch_123 string ch_456], result
       end
 
       should "process arrays with v2 semantics" do
@@ -248,7 +248,7 @@ class UtilTest < Test::Unit::TestCase
         resource2 = Stripe::Charge.construct_from(id: "ch_456", object: "charge")
         input = [resource1, "string", resource2]
         result = Util.objects_to_ids(input, :v2)
-        assert_equal ["ch_123", "string", "ch_456"], result
+        assert_equal %w[ch_123 string ch_456], result
       end
 
       should "handle complex nested structures with v1 semantics" do