diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9379a5eb..6e4ceeb8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
     branches: [main]
     tags: ['v*']
 
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
   check-changelog:
@@ -135,6 +138,7 @@ jobs:
   # The only check the ruleset requires, so jobs can change without touching repo settings.
   ci-pass:
     if: always()
+    permissions: {}
     needs:
       - check-changelog
       - frontend
diff --git a/changelog/164.trivial.md b/changelog/164.trivial.md
new file mode 100644
index 00000000..5f39a38b
--- /dev/null
+++ b/changelog/164.trivial.md
@@ -0,0 +1 @@
+Gave the `ci-pass` CI job no token permissions.