diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 057fd7a..8f40507 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
diff --git a/.github/workflows/guard-check.yml b/.github/workflows/guard-check.yml
index 4421c35..f783a9f 100644
--- a/.github/workflows/guard-check.yml
+++ b/.github/workflows/guard-check.yml
@@ -4,6 +4,10 @@ on:
     branches: [master, dev]
   pull_request:
     branches: [master, dev]
+
+permissions:
+  contents: read
+
 jobs:
   guard-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 105987e..ebf556d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,6 +4,10 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+
+permissions:
+  contents: read
+
 jobs:
   yaml-lint:
     runs-on: ubuntu-latest
@@ -30,4 +34,4 @@ jobs:
               sys.exit(1)
           else:
               print(f'All {len(files)} YAML files valid')
-          "
\ No newline at end of file
+          "
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ecfdfaa..4cb3fb1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.0.2
+
+- Restricted all GitHub Actions workflow tokens to read-only repository contents, resolving the three least-privilege code-scanning alerts without changing workflow behavior.
+
 ## 2.0.1
 
 - Upgraded the pytest development dependency to 9.0.3 or later to address CVE-2025-71176 insecure temporary-directory handling.
diff --git a/distribution.yaml b/distribution.yaml
index bc4a929..b7ac148 100644
--- a/distribution.yaml
+++ b/distribution.yaml
@@ -1,6 +1,6 @@
 # violin - supervised agentic Hermes pentest profile
 name: violin
-version: 2.0.1
+version: 2.0.2
 description: "A supervised agentic Hermes penetration testing profile for authorised Kali/Parrot-based security assessment, reconnaissance, exploit validation, and reporting workflows."
 hermes_requires: ">=0.18.0"
 author: "Violin contributors"
diff --git a/plugins/violin_guard/plugin.yaml b/plugins/violin_guard/plugin.yaml
index 2b6ae4f..4b0d95d 100644
--- a/plugins/violin_guard/plugin.yaml
+++ b/plugins/violin_guard/plugin.yaml
@@ -1,5 +1,5 @@
 name: violin-guard
-version: "2.0.1"
+version: "2.0.2"
 description: Typed scope guards and an execute-and-record boundary with bounded synchronization windows.
 kind: standalone
 provides_tools:
diff --git a/pyproject.toml b/pyproject.toml
index 4426bac..e59db27 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "violin"
-version = "2.0.1"
+version = "2.0.2"
 description = "Supervised agentic Hermes penetration-testing profile"
 requires-python = ">=3.11"
 dependencies = ["filelock>=3.13,<4"]
diff --git a/uv.lock b/uv.lock
index 707f5f2..70ed9fe 100644
--- a/uv.lock
+++ b/uv.lock
@@ -154,7 +154,7 @@ wheels = [
 
 [[package]]
 name = "violin"
-version = "2.0.1"
+version = "2.0.2"
 source = { virtual = "." }
 dependencies = [
     { name = "filelock" },