diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
index 7e106154..77d20d48 100644
--- a/.github/workflows/changesets.yml
+++ b/.github/workflows/changesets.yml
@@ -6,6 +6,9 @@ on:
 env:
   CI: true
 
+permissions:
+  contents: read
+
 jobs:
   version:
     timeout-minutes: 15
@@ -15,6 +18,11 @@ jobs:
       contents: write # Required for changesets to push version commit
       pull-requests: write # Required for changesets to create PRs
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
       - name: Checkout code repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with: