diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4ad54d..310f8c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,10 +3,16 @@ name: UI CI
 on:
   pull_request:
     branches:
-      - main
+      - production
   push:
     branches:
-      - main
+      - production
+
+# Default-deny: jobs that need write scopes must opt up explicitly.
+# Prevents the GitHub Actions Cache poisoning + OIDC-token-write attack chain
+# documented in the May 2026 TanStack supply-chain compromise.
+permissions:
+  contents: read
 
 jobs:
   lint: