diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml
index b356e74..4bb0d49 100644
--- a/.github/workflows/ossf-scorecard.yaml
+++ b/.github/workflows/ossf-scorecard.yaml
@@ -17,8 +17,14 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-24.04
     permissions:
-      # Needed to checkout the repository.
+      # Needed to checkout the repository and for scorecard to analyze commits.
       contents: read
+      # Needed for scorecard to analyze CI/CD workflows.
+      actions: read
+      # Needed for scorecard checks on private repositories.
+      issues: read
+      pull-requests: read
+      checks: read
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
       # Needed to publish results and get a badge (see publish_results below).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3baccc3..ae1024a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ Instead this file uses a date-based structure.
 
 ### Fixed
 
-- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions. Added missing `contents: read` permission to `ossf-scorecard` job.
+- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions. Added full set of read permissions to `ossf-scorecard` job as recommended for private repositories (`contents`, `actions`, `issues`, `pull-requests`, `checks`).
 
 ## 2026-01-23