diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml
index ef5d1bf..55f7260 100644
--- a/.github/workflows/hugo.yml
+++ b/.github/workflows/hugo.yml
@@ -22,10 +22,12 @@ concurrency:
   group: "pages"
   cancel-in-progress: false
 
+# The build needs nothing beyond the source and the Pages configuration it
+# reads to compute the base URL. Publishing rights are granted to the deploy
+# job alone, below, so a pull request build cannot replace what is served.
 permissions:
   contents: read
-  pages: write
-  id-token: write
+  pages: read
 
 env:
   # Pin Hugo so site builds don't break when a new release ships
@@ -75,6 +77,10 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     needs: build
     steps:
       - name: Deploy to GitHub Pages