diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9aca506..b00e3d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,18 @@ on:
   pull_request:
     branches: [main]
 
+# Reading is all the token does here: checkout, and, only when the runner's
+# tool cache lacks the Node asked for, setup-node's lookup of the Node release
+# manifest. This workflow writes nothing back — no comment, no commit, no
+# release — and setup-node saves its npm cache with the runner's own token,
+# which `permissions` does not govern. Spelled out rather than left to the
+# repository default, which lives in the settings rather than in this file
+# and can grant write to almost every scope without anyone touching a
+# workflow file. Mirrors release.yml, which asks for `contents: write`
+# because it genuinely creates a GitHub Release.
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
diff --git a/package-lock.json b/package-lock.json
index c631a6a..e0f7aa2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1320,9 +1320,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {