diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8fb3049..2a0ba44 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,9 +9,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   run-tests:
-    runs-on: macos-latest
+    runs-on: macos-26
     steps:
     - name: Checkout
       uses: actions/checkout@v6