diff --git a/.github/workflows/ci-integration.yml b/.github/workflows/ci-integration.yml
index 9237465ff..ca799a439 100644
--- a/.github/workflows/ci-integration.yml
+++ b/.github/workflows/ci-integration.yml
@@ -3,9 +3,6 @@ name: Integration Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   # ── Integration test matrix ─────────────────────────────────────────
   # Each test-group runs on a SEPARATE runner per OS, giving full process
diff --git a/.github/workflows/ci-quality.yml b/.github/workflows/ci-quality.yml
index eebc68160..14318916c 100644
--- a/.github/workflows/ci-quality.yml
+++ b/.github/workflows/ci-quality.yml
@@ -3,9 +3,6 @@ name: Quality Checks
 on:
   workflow_call:
 
-permissions:
-  contents: read
-
 jobs:
   typecheck:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci-unit-tests.yml b/.github/workflows/ci-unit-tests.yml
index 8c7fb329f..28fcc1984 100644
--- a/.github/workflows/ci-unit-tests.yml
+++ b/.github/workflows/ci-unit-tests.yml
@@ -3,10 +3,6 @@ name: Unit Tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
-  pull-requests: write
-
 jobs:
   unit-tests:
     name: unit (ubuntu / coverage)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6088b06aa..20fda22ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,10 +7,6 @@ on:
     branches: [main]
   workflow_call:
 
-permissions:
-  contents: read
-  pull-requests: write
-
 # ── Reusable workflow orchestration ─────────────────────────────────
 # Each concern lives in its own workflow file for maintainability:
 #   ci-quality.yml       — typecheck (tsc --noEmit)
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5bade4347..63a9fd58d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,6 +5,11 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+  id-token: write
+  pull-requests: write
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml