diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4a384f8b..67c7f4af4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Minimal token scope — all jobs only checkout, install, build, and test.
+# None of them push code, comment on PRs, or call mutating GitHub APIs.
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint