diff --git a/.editorconfig b/.editorconfig
index 16f2f22..7446599 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -9,7 +9,7 @@ trim_trailing_whitespace = true
 [*.md]
 indent_size = 1
 
-[*.{ast,nix,sh,vim}]
+[*.{ast,nix,sh,vim,yaml}]
 indent_size = 2
 
 [*.patch]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yaml
similarity index 63%
rename from .github/workflows/ci.yml
rename to .github/workflows/ci.yaml
index 99461d6..647d849 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yaml
@@ -3,6 +3,9 @@ on:
   pull_request:
   push:
 
+permissions:
+  contents: read
+
 env:
   RUST_BACKTRACE: full
 
@@ -15,6 +18,8 @@ jobs:
         uses: actions/checkout@v3
       - name: Install Nix
         uses: cachix/install-nix-action@v17
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare devShell
         run: nix develop --command true
       - name: Install NPM packages
@@ -25,12 +30,14 @@ jobs:
   test:
     name: Test
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
         channel: [stable, beta]
         include:
           - os: ubuntu-latest
-            channel: "1.62.0"
+            # Should be sync with Cargo.toml
+            channel: '1.66'
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
@@ -38,10 +45,11 @@ jobs:
       # For builtins.
       - name: Install Nix
         uses: cachix/install-nix-action@v17
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1
         with:
-          profile: minimal
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@master
+        with:
           toolchain: ${{ matrix.channel }}
       - name: Build
         run: cargo build --all
@@ -49,9 +57,11 @@ jobs:
         run: cargo test --all -- --include-ignored
 
   nix-flake:
-    name: Nix package (flake)
+    name: Flake package
     strategy:
+      fail-fast: false
       matrix:
+        deps: [latest, locked]
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -59,14 +69,24 @@ jobs:
         uses: actions/checkout@v3
       - name: Install Nix
         uses: cachix/install-nix-action@v17
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Flake update
+        if: matrix.deps == 'latest'
+        # https://github.com/actions/checkout/tree/v3.3.0#push-a-commit-using-the-built-in-token
+        run: |
+          git config user.name github-actions
+          git config user.email github-actions@github.com
+          nix flake update --commit-lock-file
       - name: Flake check
-        run: nix flake check --no-update-lock-file --show-trace --verbose
+        run: nix flake check --no-update-lock-file --show-trace
       - name: Flake build
-        run: nix build --no-update-lock-file --show-trace --verbose --print-build-logs
+        run: nix build --no-update-lock-file --show-trace --print-build-logs
 
   nix-legacy:
-    name: Nix package (legacy)
+    name: Legacy package
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
@@ -80,5 +100,6 @@ jobs:
         uses: cachix/install-nix-action@v17
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Nix build
-        run: nix-build --show-trace --verbose
+        run: nix-build --show-trace
diff --git a/Cargo.toml b/Cargo.toml
index 0cda3ff..6661388 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,6 +12,7 @@ members = [
 version = "0.0.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
+# Should be sync with CI.
 rust-version = "1.66"
 
 [profile.dev]