diff --git a/.github/workflows/fix-vulnerabilities.yaml b/.github/workflows/fix-vulnerabilities.yaml
index 9e65e9e..6903b4b 100644
--- a/.github/workflows/fix-vulnerabilities.yaml
+++ b/.github/workflows/fix-vulnerabilities.yaml
@@ -25,10 +25,14 @@ on:
         description: Nancy user used to access the OSS Index database
         required: true
 
+permissions: {}
+
 jobs:
   gather_facts:
     name: Gather facts
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     outputs:
       branch: ${{ steps.gather_facts.outputs.branch }}
       skip: ${{ steps.gather_facts.outputs.skip }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8f55ab..691dc37 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ Instead this file uses a date-based structure.
 
 ### Changed
 
+- Restrict permissions for GITHUB_TOKEN in "Fix Vulnerabilities" workflow.
 - Restrict permissions for GITHUB_TOKEN in "Create Release PR" workflow.
 
 ## 2026-01-16