diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c55bfd..990bb81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,13 @@ on:
   merge_group:
   workflow_dispatch:
 
+# Read-only GITHUB_TOKEN for every job that does not say otherwise (publish
+# and prerelease declare their own blocks, which replace this one). Keeps a
+# future job from silently inheriting write access, and satisfies CodeQL
+# actions/missing-workflow-permissions.
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest