diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index 369d25bf..e215d112 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '0 8 * * *' # Cron uses UTC; run at nightly at midnight PST
 
+permissions:
+  contents: read
+
 jobs:
   cron:
     runs-on: ${{ matrix.os }}
@@ -18,7 +21,7 @@ jobs:
         os: [macos-15]
   
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Archive for iOS
@@ -33,3 +36,26 @@ jobs:
           archive \
           -scheme GoogleSignIn-Package \
           -destination "platform=OS X"
+
+  xcode-27-preview-archive:
+    # Archive every supported platform against the Xcode 27 preview image. The
+    # image is preview, so this job does not block merges.
+    # https://github.com/actions/runner-images/issues/14404
+    runs-on: xcode-27
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        destination: [
+          'generic/platform=iOS',
+          'platform=OS X'
+        ]
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Archive
+      run: |
+        xcodebuild \
+          archive \
+          -scheme GoogleSignIn-Package \
+          -destination "${{ matrix.destination }}"
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index fe2eb6cc..40a305c6 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -7,6 +7,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
     
   pod-lib-lint:
@@ -24,7 +27,7 @@ jobs:
           - podspec: GoogleSignInSwiftSupport.podspec
             includePodspecFlag: "--include-podspecs='GoogleSignIn.podspec'"
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Update Bundler
       run: bundle update --bundler
     - name: Install Ruby gems with Bundler
@@ -47,7 +50,7 @@ jobs:
           - sdk: 'iphonesimulator'
             destination: '"platform=iOS Simulator,name=iPhone 16,OS=18.6"'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Select Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Build unit test target
@@ -65,3 +68,35 @@ jobs:
           -destination ${{ matrix.destination }} \
           test-without-building
 
+  xcode-27-preview-test:
+    # Build and run the unit tests against the Xcode 27 preview image. Xcode 27
+    # beta is the only (thus, default) Xcode on that image, so no xcode-select
+    # step is needed. The image is preview, so this job does not block merges.
+    # https://github.com/actions/runner-images/issues/14404
+    runs-on: xcode-27
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sdk: ['macosx', 'iphonesimulator']
+        include:
+          - sdk: 'macosx'
+            destination: '"platform=macOS"'
+          - sdk: 'iphonesimulator'
+            destination: '"platform=iOS Simulator,name=iPhone 17,OS=27.0"'
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Build unit test target
+      run: |
+        xcodebuild \
+          -scheme GoogleSignIn-Package \
+          -sdk ${{ matrix.sdk }} \
+          -destination ${{ matrix.destination }} \
+          build-for-testing
+    - name: Run unit test target
+      run: |
+        xcodebuild \
+          -scheme GoogleSignIn-Package \
+          -sdk ${{ matrix.sdk }} \
+          -destination ${{ matrix.destination }} \
+          test-without-building