diff --git a/.github/workflows/github-shared.yml b/.github/workflows/github-shared.yml
index b12a805..e43312b 100644
--- a/.github/workflows/github-shared.yml
+++ b/.github/workflows/github-shared.yml
@@ -11,6 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      issues: read
     steps:
       - uses: $/.github/actions/check-github-config
         with:
diff --git a/test/test_github_config.py b/test/test_github_config.py
index 9e072dd..9597fba 100644
--- a/test/test_github_config.py
+++ b/test/test_github_config.py
@@ -4,6 +4,8 @@
 import unittest
 from pathlib import Path
 
+import yaml
+
 BASELINE_ROOT = Path(__file__).parent.parent
 SPEC = importlib.util.spec_from_file_location(
     "check_github_config", BASELINE_ROOT / ".github" / "actions" / "check-github-config" / "check.py"
@@ -43,6 +45,14 @@ def test_loads_repository_config(self):
             "Pull requests that update a dependency file",
         )
 
+    def test_shared_workflow_grants_permissions_for_repository_and_label_checks(self):
+        with open(BASELINE_ROOT / ".github" / "workflows" / "github-shared.yml") as workflow_file:
+            workflow = yaml.safe_load(workflow_file)
+
+        permissions = workflow["jobs"]["github-config-check"]["permissions"]
+
+        self.assertEqual(permissions, {"contents": "read", "issues": "read"})
+
     def test_rejects_invalid_repository_config(self):
         with tempfile.NamedTemporaryFile(mode="w", suffix=".yml") as config:
             config.write("config:\n  invalid-field: false\n")