diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f2e52791d..7a831c9c0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -26,6 +26,9 @@ jobs:
       - name: Check out project repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          # Nothing here pushes: the build uploads an artifact and
+          # deploy-pages authenticates with its own id-token.
+          persist-credentials: false
           # The docs pages date themselves from when git last touched them,
           # which a single-commit checkout cannot answer.
           fetch-depth: 0
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index 9f49f338e..04f086081 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -10,6 +10,12 @@ on:
     branches:
       - live
 
+# Stated, not inherited: paths-filter needs `pull-requests: read`, and naming
+# any permission drops the rest to none.
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   lint_and_test:
     name: Lint and test
@@ -21,6 +27,10 @@ jobs:
           # `verify.commits` compares against the base branch, which a
           # single-commit checkout does not contain.
           fetch-depth: 0
+          # Otherwise the token stays in .git/config while `pnpm install` and
+          # the linters run. Nothing downstream needs it: no step pushes, and
+          # no dependency is git-hosted.
+          persist-credentials: false
       - name: Set up Node.js runtime
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
diff --git a/.github/workflows/pull-request-policy.yml b/.github/workflows/pull-request-policy.yml
index 66b19cee9..bb1916996 100644
--- a/.github/workflows/pull-request-policy.yml
+++ b/.github/workflows/pull-request-policy.yml
@@ -29,6 +29,10 @@ jobs:
     steps:
       - name: Check out project repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes, and a token left in .git/config is one more
+          # thing that could be picked up by something that should not have it.
+          persist-credentials: false
       - name: Set up Node.js runtime
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
diff --git a/.github/workflows/vendored-sync.yml b/.github/workflows/vendored-sync.yml
index 10091c3af..5dd0a32a6 100644
--- a/.github/workflows/vendored-sync.yml
+++ b/.github/workflows/vendored-sync.yml
@@ -37,6 +37,10 @@ jobs:
     steps:
       - name: Check out project repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Nothing here pushes, and a token left in .git/config is one more
+          # thing that could be picked up by something that should not have it.
+          persist-credentials: false
       - name: Set up Node.js runtime
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: