diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index a70fd9f..f9ab0e1 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -16,6 +16,18 @@ on:
   pull_request:
     branches: [master]
 
+# Least-privilege token. Without this block a job gets whatever the
+# repository's default GITHUB_TOKEN scope is, which is broader than
+# anything here needs — CodeQL's actions/missing-workflow-permissions
+# flagged every job in this file. Nothing here writes through the API:
+# no `gh` calls, no git push, no package publish. Artifact upload does
+# not need a contents scope either (it uses the runtime token).
+#
+# A job that genuinely needs more should declare it at the JOB level
+# rather than widening this.
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Lint + import