diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index ef425c0..fe70c51 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -29,7 +29,12 @@ on:
       - '.github/workflows/container-build.yml'
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: container-build-${{ github.ref }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 2c63785..621ca9d 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -25,7 +25,12 @@ on:
     branches: [main, master]
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: e2e-${{ github.ref }}
diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml
index 8638a1d..f72f34b 100644
--- a/.github/workflows/install-smoke.yml
+++ b/.github/workflows/install-smoke.yml
@@ -22,7 +22,12 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: install-smoke-${{ github.ref }}
diff --git a/.github/workflows/zig.yml b/.github/workflows/zig.yml
index 0a65d9f..d59a357 100644
--- a/.github/workflows/zig.yml
+++ b/.github/workflows/zig.yml
@@ -23,7 +23,12 @@ on:
       - '.github/workflows/zig.yml'
   workflow_dispatch:
 
-permissions: read-all
+# Explicit rather than `read-all`: every job here only checks out and builds.
+# Naming the one scope it needs also removes the last scalar `permissions:`
+# block, which is what let a text-matching sweep produce invalid YAML twice
+# (fixed #64, reintroduced #68, re-fixed #69).
+permissions:
+  contents: read
 
 concurrency:
   group: zig-${{ github.ref }}