diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 71cf3152..6da9fc50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,11 +6,16 @@ on:
   pull_request: ~
   workflow_dispatch: ~
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v3
       - uses: shivammathur/setup-php@v2
         with:
@@ -26,6 +31,8 @@ jobs:
         phpversion: ['8.1', '8.2', '8.3', '8.4', '8.5']
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v3
       - uses: shivammathur/setup-php@v2
         with:
@@ -52,8 +59,12 @@ jobs:
   docs:
     if: github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # peaceiris/actions-gh-pages pushes to gh-pages
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: extractions/setup-just@v3
       - uses: shivammathur/setup-php@v2
         with: