diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4e3e5f..fe3ae4f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,10 @@ on:
   # publish.yml calls this workflow so a release tag publishes only after the same tests pass.
   workflow_call:
 
+# Tests only read the repo. (Called from publish.yml, this cannot widen the caller's token either.)
+permissions:
+  contents: read
+
 jobs:
   test:
     # Pinned to ubuntu-24.04: ubuntu-latest moves to Ubuntu 26 from 2026-10-19. Unpin once 26.04 is verified.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 210a89e..f845c3f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Build sdist and wheel
         working-directory: packages/embeddedci
         run: |
-          python -m pip install --upgrade build twine
+          python -m pip install "build==1.6.1" "twine==7.0.0"
           python -m build
           twine check dist/*
       - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
@@ -93,7 +93,7 @@ jobs:
       - name: Build sdist and wheel
         working-directory: packages/embeddedci-py39-shim
         run: |
-          python -m pip install --upgrade build twine
+          python -m pip install "build==1.6.1" "twine==7.0.0"
           python -m build
           twine check dist/*
       - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
@@ -116,7 +116,7 @@ jobs:
       - name: Build sdist and wheel
         working-directory: packages/embeddedci-mcp
         run: |
-          python -m pip install --upgrade build twine
+          python -m pip install "build==1.6.1" "twine==7.0.0"
           python -m build
           twine check dist/*
       - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
@@ -139,7 +139,7 @@ jobs:
       - name: Build sdist and wheel
         working-directory: packages/embeddedci-openhtf
         run: |
-          python -m pip install --upgrade build twine
+          python -m pip install "build==1.6.1" "twine==7.0.0"
           python -m build
           twine check dist/*
       - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3