diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 7a399726d..7995cc21f 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -2,14 +2,20 @@ name: Auto-merge Dependabot
 
 on: pull_request
 
+# Nothing outside the one job needs more than a checkout, so the default for
+# the workflow is read-only and the write scopes sit on the job that spends
+# them: `gh pr merge --auto` writes to the repository's merge queue state, and
+# both the merge and the review comment write to the pull request.
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1