diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index a3b450f7..2890e046 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -31,6 +31,8 @@ jobs:
   workflow_syntax:
     if: github.repository_owner == 'Homebrew'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Set up Homebrew
         id: setup-homebrew
@@ -45,7 +47,7 @@ jobs:
 
       - uses: actions/checkout@v4
         with:
-          persist-credentials: ${{ github.event.repository.private }}
+          persist-credentials: false
 
       - run: zizmor --format sarif . >results.sarif