diff --git a/.github/workflows/check-os.yaml b/.github/workflows/check-os.yaml
index c5078ab..96cec25 100644
--- a/.github/workflows/check-os.yaml
+++ b/.github/workflows/check-os.yaml
@@ -7,6 +7,8 @@ on:
 
 name: R-CMD-check-OS-R
 
+permissions: read-all
+
 env:
   NCPUS: 2
 
@@ -20,13 +22,13 @@ jobs:
       fail-fast: false
       matrix:
         config:
-          - {os: macOS-latest,  r: 'oldrel-1'}
-          - {os: macOS-latest,  r: 'release'}
-          - {os: windows-2022,  r: 'oldrel-1'}
-          - {os: windows-2022,  r: 'release'}
-          - {os: ubuntu-latest, r: 'oldrel-1'}
-          - {os: ubuntu-latest, r: 'release'}
-          - {os: ubuntu-latest, r: 'devel', http-user-agent: 'release'}
+          - {os: macos-latest,   r: 'release'}
+          - {os: windows-latest, r: 'release'}
+          # use 4.1 to check with rtools40's older compiler
+          - {os: windows-latest, r: '4.1'}
+          - {os: ubuntu-latest,   r: 'devel', http-user-agent: 'release'}
+          - {os: ubuntu-latest,   r: 'release'}
+          - {os: ubuntu-latest,   r: 'oldrel-1'}
           
     env:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
@@ -35,7 +37,7 @@ jobs:
       RSPM: ${{ matrix.config.rspm }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@4
 
       - uses: r-lib/actions/setup-pandoc@v2
 
@@ -67,4 +69,4 @@ jobs:
         uses: actions/upload-artifact@v2
         with:
           name: ${{ runner.os }}-r${{ matrix.config.r }}-results
-          path: check
\ No newline at end of file
+          path: check