diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f420e10e..b33b2224 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 env:
   XCODE_VERSION: 26.5
 
diff --git a/.github/workflows/fuzz-extended.yml b/.github/workflows/fuzz-extended.yml
index 496bd7da..1ba60c6f 100644
--- a/.github/workflows/fuzz-extended.yml
+++ b/.github/workflows/fuzz-extended.yml
@@ -12,6 +12,9 @@ on:
         default: '480'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   extended_fuzz:
     runs-on: ubuntu-22.04
diff --git a/cli/src/main.rs b/cli/src/main.rs
index 06e97161..4d8c9d6b 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -569,7 +569,7 @@ fn print_header(data: String) {
                 devolutions_crypto::ciphertext::Ciphertext,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -579,7 +579,7 @@ fn print_header(data: String) {
                 devolutions_crypto::password_hash::PasswordHash,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -589,7 +589,7 @@ fn print_header(data: String) {
                 devolutions_crypto::secret_sharing::Share,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }
@@ -600,13 +600,13 @@ fn print_header(data: String) {
                     &data[0..8],
                 )
             {
-                println!("{:?}", &h);
+                println!("{:?}", h);
             } else if let Ok(h) =
                 devolutions_crypto::Header::<devolutions_crypto::key::PrivateKey>::try_from(
                     &data[0..8],
                 )
             {
-                println!("{:?}", &h);
+                println!("{:?}", h);
             } else {
                 println!("Invalid Header");
             }
@@ -616,7 +616,7 @@ fn print_header(data: String) {
                 devolutions_crypto::derive_encrypt::KdfEncryptedData,
             >::try_from(&data[0..8])
             {
-                println!("{:?}", &header);
+                println!("{:?}", header);
             } else {
                 println!("Invalid Header");
             }