diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 01ca27e133..a901a4ee46 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -11,6 +11,9 @@ on:
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 7254f19515..c291c6565e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -14,8 +14,14 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
     name: Lint and test
     strategy:
       fail-fast: false
@@ -194,6 +200,8 @@ jobs:
           parallel: true
 
   finish:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
     needs: test
     runs-on: ubuntu-latest
     steps:
diff --git a/install/package.json b/install/package.json
index b00e04bb49..a37a4e2756 100644
--- a/install/package.json
+++ b/install/package.json
@@ -58,6 +58,7 @@
         "csurf": "1.11.0",
         "daemon": "1.1.0",
         "diff": "5.1.0",
+        "esbuild": "0.15.10",
         "express": "4.18.1",
         "express-session": "1.17.3",
         "express-useragent": "1.0.15",
@@ -129,6 +130,7 @@
         "sortablejs": "1.15.0",
         "spdx-license-list": "6.6.0",
         "spider-detector": "2.0.0",
+        "terser-webpack-plugin": "5.3.6",
         "textcomplete": "0.18.2",
         "textcomplete.contenteditable": "0.1.1",
         "timeago": "1.6.7",
diff --git a/webpack.prod.js b/webpack.prod.js
index 523e011f3d..4cecee7d9c 100644
--- a/webpack.prod.js
+++ b/webpack.prod.js
@@ -1,8 +1,19 @@
 'use strict';
 
 const { merge } = require('webpack-merge');
+const TerserPlugin = require('terser-webpack-plugin');
+
 const common = require('./webpack.common');
 
 module.exports = merge(common, {
 	mode: 'production',
+	optimization: {
+		minimize: true,
+		minimizer: [
+			new TerserPlugin({
+				minify: TerserPlugin.esbuildMinify,
+				terserOptions: {},
+			}),
+		],
+	},
 });