diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ec8a2d9..2118df1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,7 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: pypi
     permissions:
-      # Required for OIDC. Nothing else is, and nothing else is granted.
+      # Naming any permission REPLACES the default set, so contents: read has to
+      # be asked for — without it actions/checkout cannot read a private
+      # repository and fails with "Repository not found", which reads like the
+      # repo is gone rather than like a missing scope.
+      contents: read
+      # OIDC, which is what removes the need for an API token.
       id-token: write
     steps:
       - uses: actions/checkout@v4