diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml
index 1e42659..b356e74 100644
--- a/.github/workflows/ossf-scorecard.yaml
+++ b/.github/workflows/ossf-scorecard.yaml
@@ -17,6 +17,8 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-24.04
     permissions:
+      # Needed to checkout the repository.
+      contents: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 197eb00..3baccc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ Instead this file uses a date-based structure.
 
 ### Fixed
 
-- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions.
+- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions. Added missing `contents: read` permission to `ossf-scorecard` job.
 
 ## 2026-01-23