diff --git a/.github/workflows/require-maintainer-approval.yml b/.github/workflows/require-maintainer-approval.yml
index ad235cd..0a7e292 100644
--- a/.github/workflows/require-maintainer-approval.yml
+++ b/.github/workflows/require-maintainer-approval.yml
@@ -13,12 +13,15 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
-  statuses: write
 
 jobs:
   gate:
     runs-on: ubuntu-latest
+    # Reads the PR and its reviews, then fails the job if no maintainer
+    # approved the head commit. It writes nothing, so no write scope.
+    permissions:
+      contents: read
+      pull-requests: read
     if: github.event.pull_request.base.ref == 'main'
     steps:
       - name: Check for maintainer approval