diff --git a/.github/actions/setup-poetry/action.yml b/.github/actions/setup-poetry/action.yml
index eaebe6a..68cf2ce 100644
--- a/.github/actions/setup-poetry/action.yml
+++ b/.github/actions/setup-poetry/action.yml
@@ -6,6 +6,10 @@ inputs:
     required: false
     description: "The python version to use"
     default: "3.12"
+  poetry-version:
+    required: false
+    description: "The poetry version to use"
+    default: "1.8.3"
 
 runs:
   using: "composite"
@@ -14,21 +18,29 @@ runs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ inputs.python-version }}
-
-    - name: Install Poetry
-      uses: snok/install-poetry@v1
-      with:
-        virtualenvs-in-project: true
-        plugins: poetry-plugin-export
+        cache: 'pip'
 
     - name: Load cached venv
       id: cached-poetry-dependencies
       uses: actions/cache@v4
       with:
         path: .venv
-        key: venv-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('poetry.lock') }}
+        key: venv-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('**/poetry.lock') }}
+        restore-keys: |
+          venv-${{ runner.os }}-${{ inputs.python-version }}-
+
+    - name: Install Poetry
+      if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
+      uses: snok/install-poetry@v1
+      with:
+        version: ${{ inputs.poetry-version }}
+        virtualenvs-in-project: true
+        installer-parallel: true
+        plugins: poetry-plugin-export
 
     - name: Install dependencies
       if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
-      run: poetry install --no-interaction
+      run: |
+        poetry config virtualenvs.in-project true
+        poetry install --no-interaction --no-root
       shell: bash
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7fa0fbb..0911c56 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -9,6 +9,8 @@ on:
 jobs:
   quality-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out
         uses: actions/checkout@v4
@@ -21,6 +23,8 @@ jobs:
 
   tox:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
@@ -29,30 +33,36 @@ jobs:
       - name: Check out
         uses: actions/checkout@v4
 
-      - name: Set up python
-        uses: actions/setup-python@v5
+      - name: Set up poetry
+        uses: ./.github/actions/setup-poetry
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Install Poetry
-        uses: snok/install-poetry@v1
-
-      - name: Load cached venv
+      - name: Load cached tox
+        id: cached-tox
         uses: actions/cache@v4
         with:
           path: .tox
-          key: venv-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }}
+          key: tox-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }}-${{ hashFiles('tox.ini') }}
+          restore-keys: |
+            tox-${{ runner.os }}-${{ matrix.python-version }}-
 
       - name: Install tox
+        if: steps.cached-tox.outputs.cache-hit != 'true'
         run: |
           python -m pip install --upgrade pip
           python -m pip install tox tox-gh-actions
 
       - name: Test with tox
         run: tox
+        env:
+          PYTHON_VERSION: ${{ matrix.python-version }}
 
   docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    if: github.event_name != 'pull_request'
     steps:
       - name: Check out
         uses: actions/checkout@v4