diff --git a/.github/workflows/reusable-validate.yml b/.github/workflows/reusable-validate.yml
index cc6142d..8abfeb8 100644
--- a/.github/workflows/reusable-validate.yml
+++ b/.github/workflows/reusable-validate.yml
@@ -3,11 +3,13 @@ name: Validate
 on:
   workflow_call:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To clone the repo.
 
     strategy:
       fail-fast: true
@@ -15,6 +17,7 @@ jobs:
         php: ['5.4', 'latest']
 
     name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validate-cron.yml b/.github/workflows/validate-cron.yml
index d0a6455..195d230 100644
--- a/.github/workflows/validate-cron.yml
+++ b/.github/workflows/validate-cron.yml
@@ -5,11 +5,16 @@ on:
   schedule:
     - cron: '0 0 15 * *'
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
+    permissions:
+      contents: read # To clone the repo.
+
     # Don't run the cron job on forks.
     if: ${{ github.event.repository.fork == false }}
 
+    name: Validate
     uses: ./.github/workflows/reusable-validate.yml
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 4316519..ff61b0b 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -7,8 +7,13 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+# Permissions should be configured at the job level.
 permissions: {}
 
 jobs:
   validate:
+    permissions:
+      contents: read # To clone the repo.
+
+    name: Validate
     uses: ./.github/workflows/reusable-validate.yml