diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8059ed0..d60a965 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: "JDK ${{ matrix.java }}"
@@ -23,6 +26,8 @@ jobs:
     steps:
       - name: 'Check out repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          persist-credentials: false
       - name: 'Cache Bazel dependencies'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with: