diff --git a/README.md b/README.md
index b70f9e6..a5f0dcf 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,9 @@ on:
   pull_request:
 jobs:
   github:
+    permissions:
+      contents: read
+      issues: read
     uses: rubykatzen/baseline/.github/workflows/github-shared.yml@v0.16.2
 ```
 
@@ -63,6 +66,9 @@ Baseline checks the repository settings and labels against
 automatic branch deletion, auto-merge, and the canonical label set and colors.
 Release Please labels are allowed but optional.
 
+The caller grants both permissions because a reusable workflow can reduce its
+caller's `GITHUB_TOKEN` permissions, but cannot elevate them.
+
 ## Check shared repository files
 
 Create `.github/workflows/embedder.yml`: