diff --git a/.github/workflows/ci-self-test.yml b/.github/workflows/ci-self-test.yml
index 5180bcd..4cb4e7c 100644
--- a/.github/workflows/ci-self-test.yml
+++ b/.github/workflows/ci-self-test.yml
@@ -1,10 +1,8 @@
 # Self-test: exercises the reusable ci.yml on this repo itself.
 # Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
-# Purpose: smoke-check that the reusable workflow parses and the job
-# skeleton runs without YAML/startup errors.
-#
-# Note: uses a relative path (./.github/workflows/ci.yml) — the correct
-# form for same-repo reusable workflow calls on PR branches.
+# phpcs_autofix: false avoids needing contents: write at the caller level
+# (the phpcs job in ci.yml has its own job-level write permission for phpcbf).
+# Purpose: smoke-check that the reusable workflow skeleton runs without errors.
 
 name: CI Self-Test (reusable ci.yml)
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d5856a..ac0880d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,6 +50,9 @@
 #         and concatenated verbatim — missing slash produces wrong path).
 #   - Every repo calls `composer test` regardless of the `tests` input; the
 #     input only controls environment provisioning, not the command.
+#   - permissions: contents: read at workflow level; the phpcs job sets
+#     contents: write for phpcbf commit-back only. Calling workflows do NOT
+#     need to declare contents: write — job-level override is sufficient.
 ##
 
 name: CI — Reusable
@@ -98,7 +101,7 @@ on:
         type: boolean
 
 permissions:
-  contents: write  # required for phpcbf auto-commit to the PR branch
+  contents: read  # jobs that need write declare it explicitly (phpcs)
 
 jobs:
 
@@ -139,6 +142,8 @@ jobs:
   phpcs:
     name: PHPCS (WordPress standards)
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # allows phpcbf auto-fix commits back to the PR branch
     steps:
       - uses: actions/checkout@v4
         with: