diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 5e64dd3..70167af 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -6,8 +6,11 @@ on:
   pull_request:
   workflow_dispatch:
 
+# The build needs nothing beyond the source. Write access to the repository
+# is granted to the deploy job alone, below, so a pull request build cannot
+# push to gh-pages.
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   # Build on every pull request as well as on main, so a change to the docs or to
@@ -55,6 +58,8 @@ jobs:
       group: gh-pages-deploy
       cancel-in-progress: false
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v7