diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 581ed4a2..a424cce7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -35,7 +35,7 @@ on:
   workflow_dispatch:
 
 # Declare default workflow permissions as read only.
-permissions: read-all
+permissions: {}
 
 concurrency:
   # Cancel any previously-started but still active runs on the same branch.
@@ -71,6 +71,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python with caching of pip dependencies
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
@@ -103,6 +105,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python with caching of pip dependencies
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
@@ -131,6 +135,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python with caching of pip dependencies
         uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
@@ -158,6 +164,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install yamllint
         run: |