diff --git a/.github/workflows/budget-snapshot-cadence.yml b/.github/workflows/budget-snapshot-cadence.yml
index c468141d3d..c8172ff790 100644
--- a/.github/workflows/budget-snapshot-cadence.yml
+++ b/.github/workflows/budget-snapshot-cadence.yml
@@ -75,18 +75,10 @@ on:
         default: ""
 
 permissions:
-  # Need contents:write to push the snapshot branch; pull-requests:write
-  # to open the snapshot PR; actions:read so snapshot-burn.sh can call
-  # the Actions REST endpoints (/repos/.../actions/runs and
-  # /actions/runs/{id}/timing) to populate burn metrics. Without
-  # actions:read, those API calls 403 silently and snapshot-burn.sh
-  # falls back to empty/zeroed timing data while still writing a
-  # snapshot — producing misleading evidence rather than a hard
-  # failure. With explicit workflow permissions, omitted scopes are
-  # `none`, so actions:read MUST be listed explicitly here.
-  contents: write
-  pull-requests: write
-  actions: read
+  # Top-level: read-only by default (per Scorecard TokenPermissions
+  # best-practice — minimize blast radius if any step is compromised).
+  # The snapshot job below scopes write permissions narrowly.
+  contents: read
 
 concurrency:
   # Only one cadence run at a time. Retriggers queue (rather than
@@ -101,6 +93,20 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
 
+    permissions:
+      # Need contents:write to push the snapshot branch; pull-requests:write
+      # to open the snapshot PR; actions:read so snapshot-burn.sh can call
+      # the Actions REST endpoints (/repos/.../actions/runs and
+      # /actions/runs/{id}/timing) to populate burn metrics. Without
+      # actions:read, those API calls 403 silently and snapshot-burn.sh
+      # falls back to empty/zeroed timing data while still writing a
+      # snapshot — producing misleading evidence rather than a hard
+      # failure. With explicit job permissions, omitted scopes are
+      # `none`, so actions:read MUST be listed explicitly here.
+      contents: write
+      pull-requests: write
+      actions: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2