diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 04a0ec7..68afe19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,12 @@ on:
   pull_request:
     branches: [main]
 
+# Least privilege: the CI job only reads the repo to run tests. Setting the
+# token scope here (rather than relying on the broad repository default)
+# clears the OpenSSF Scorecard "Token-Permissions" finding.
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest