diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 366ee03..05448bb 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,9 @@ on:
 env:
   FORCE_COLOR: "1"
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
@@ -56,3 +59,15 @@ jobs:
 
       - name: Run tests
         run: nox -s tests
+
+  validate_build:
+    name: Build artifacts
+    needs: [lint, tests]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: snapcore/action-build@v1
+        name: Build snap
+      - uses: "DeterminateSystems/nix-installer-action@main"
+      - run: nix build
+        name: Build Flake
diff --git a/.github/workflows/publish-tagged.yml b/.github/workflows/publish-tagged.yml
index d9a41e9..2a4aa35 100644
--- a/.github/workflows/publish-tagged.yml
+++ b/.github/workflows/publish-tagged.yml
@@ -9,12 +9,16 @@ on:
         description: "The existing tag to publish"
         type: "string"
         required: true
+
+permissions:
+  contents: read
+
 jobs:
   flakehub-publish:
     runs-on: "ubuntu-latest"
     permissions:
-      id-token: "write"
-      contents: "read"
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2e02cdf..d9d06a6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,6 +3,9 @@ name: Publish
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build wheel