diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bfda067..04035f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ on:
       - "*.md"
       - "sonar-project.properties"
 
+permissions:
+  contents: read
+
 jobs:
   workflow-lint:
     name: Lint (Actions)
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 0e607ec..d490c20 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -23,6 +23,10 @@ on:
       - "LICENSE"
       - ".dockerignore"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   sonarcloud:
     name: 📊 SonarCloud
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 36cdf83..d4dfc1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Least-privilege `GITHUB_TOKEN` permissions** in the `ci.yml` (`contents: read`) and `sonarcloud.yml` (`contents: read`, `pull-requests: read`) workflows — resolves CodeQL `actions/missing-workflow-permissions` alerts.
+
 ## [0.4.4] - 2026-10-18
 
 ### Fixed