diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92ff1e8..54356b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,6 @@
 name: Test IPython beamline profiles
+permissions:
+  contents: read
 
 on:
   push:
@@ -36,6 +38,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Run Integration Tests Against Beamline Profiles
         uses: NSLS2/gha-beamline-integration-test@2025-1.0-test