diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index bc239ab..f786ea2 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -14,6 +14,12 @@ concurrency:
   group: smoke-tests-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Least privilege: this workflow only reads the repo and runs untrusted
+# PR-authored example code via `make verify`. A read-only token removes the
+# write/approve escalation path if that code reaches the persisted credentials.
+permissions:
+  contents: read
+
 jobs:
   verify:
     runs-on: ubuntu-latest
@@ -38,6 +44,9 @@ jobs:
         with:
           # Full history so PR-scoped verify can diff against the base commit.
           fetch-depth: 0
+          # Do not persist GITHUB_TOKEN in .git/config: `make verify` runs
+          # untrusted PR example code, which must not be able to read the token.
+          persist-credentials: false
 
       - name: Scope verify to changed examples (pull requests only)
         env: