diff --git a/.github/workflows/stack-ci.yml b/.github/workflows/stack-ci.yml
index 1052a228..19e9235b 100644
--- a/.github/workflows/stack-ci.yml
+++ b/.github/workflows/stack-ci.yml
@@ -14,6 +14,8 @@
 
 name: Stack CI
 
+permissions: read-all
+
 on:
   push:
     branches:
@@ -79,6 +81,7 @@ jobs:
         uses: arduino/setup-protoc@v3
         with:
           version: '28.x'
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Install Stack without GHC first, so we have an opportunity to cache the
       # Pantry package index.