diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 58ab1f8..ad932b9 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -1,3 +1,6 @@
 # Rules for this project
 
 - Maintain the CHANGELOG.md
+- Use least-privilege principle for GitHub Actions permissions
+- Use `actions/checkout` with `persist-credentials: false`
+- Pin action versions to the commit SHA
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..7e5d4d4
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,4 @@
+
+## Checklist
+
+- I have updated the [CHANGELOG.md](../CHANGELOG.md) with a description of the change
diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml
index aa2e36f..1e42659 100644
--- a/.github/workflows/ossf-scorecard.yaml
+++ b/.github/workflows/ossf-scorecard.yaml
@@ -10,8 +10,7 @@ on:
       scorecard_token:
         required: true
 
-# Declare default permissions as read only.
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis:
diff --git a/.github/workflows/publish-techdocs.yaml b/.github/workflows/publish-techdocs.yaml
index 63d2773..11c46c8 100644
--- a/.github/workflows/publish-techdocs.yaml
+++ b/.github/workflows/publish-techdocs.yaml
@@ -17,12 +17,14 @@ on:
       aws_secret_access_key:
         required: true
 
-permissions: read-all
+permissions: {}
 
 jobs:
   publish:
     if: github.event.repository.visibility == 'public'
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: read
     steps:
       - name: Set up NodeJS
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3b1840..197eb00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-01-30
+
+### Fixed
+
+- Replace `permissions: read-all` with explicit job-level permissions in `ossf-scorecard` and `publish-techdocs` workflows to work correctly when called from workflows with restricted permissions.
+
 ## 2026-01-23
 
+### Added
+
+- Add pull request template with checklist for changelog.
+
 ### Changed
 
 - Set restrictive default token permissions for `create-release-pr`, `fix-vulnerabilities`, `chart-values`, `gitleaks`, `go-coverage`, `issue-to-customer-board`, `validate-changelog`, `validate-file-names`, and `validate-workflows` workflows.