diff --git a/.github/workflows/action-tests.yml b/.github/workflows/action-tests.yml
index 6e66a94..930d9f7 100644
--- a/.github/workflows/action-tests.yml
+++ b/.github/workflows/action-tests.yml
@@ -12,6 +12,9 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+permissions:
+  contents: read
+
 env:
   DEBUG: ${{ github.event.inputs.debug || false }}
   # Test for overrides in built in shell options (regression issue 98).
diff --git a/install_and_cache_pkgs.sh b/install_and_cache_pkgs.sh
index 006fda7..09dd6d8 100755
--- a/install_and_cache_pkgs.sh
+++ b/install_and_cache_pkgs.sh
@@ -108,8 +108,8 @@ for installed_package in ${installed_packages}; do
         # Include all dpkg info files for this package (list, md5sums,
         # conffiles, triggers, preinst, postinst, prerm, postrm, etc.)
         # so dpkg recognizes the package after cache restore.
-        ls -1 /var/lib/dpkg/info/${package_name}.* 2>/dev/null &&
-        ls -1 /var/lib/dpkg/info/${package_name}:*.* 2>/dev/null ; } |
+        ls -1 /var/lib/dpkg/info/${package_name}.* 2>/dev/null ||:
+        ls -1 /var/lib/dpkg/info/${package_name}:*.* 2>/dev/null ||:; } |
       while IFS= read -r f; do
         if test -f "${f}" -o -L "${f}"; then
           get_tar_relpath "${f}"
diff --git a/restore_pkgs.sh b/restore_pkgs.sh
index ef9418d..db6e0bf 100755
--- a/restore_pkgs.sh
+++ b/restore_pkgs.sh
@@ -69,7 +69,7 @@ dpkg_status_dir="${cache_dir}"
 status_files=$(ls -1 "${dpkg_status_dir}"/*.dpkg-status 2>/dev/null || true)
 if test -n "${status_files}"; then
   log "Registering restored packages with dpkg..."
-  for status_file in ${status_files}; do
+  while IFS= read -r status_file; do
     pkg_name=$(head -1 "${status_file}" | sed 's/^Package: //')
     # Skip if dpkg already knows about this package (e.g., it was pre-installed).
     if dpkg -s "${pkg_name}" > /dev/null 2>&1; then
@@ -83,6 +83,6 @@ if test -n "${status_files}"; then
     echo "" | sudo tee -a "${cache_restore_root}var/lib/dpkg/status" > /dev/null
     cat "${status_file}" | sudo tee -a "${cache_restore_root}var/lib/dpkg/status" > /dev/null
     log "- ${pkg_name} registered."
-  done
+  done <<< "${status_files}"
   log "done"
 fi