diff --git a/.github/wiki b/.github/wiki
index 223a77a..ff325b8 160000
--- a/.github/wiki
+++ b/.github/wiki
@@ -1 +1 @@
-Subproject commit 223a77a7ce47d4d2b9c215c8871205a05df6b6ea
+Subproject commit ff325b8dc40bc3bc85ce11c51a36ee961833af00
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e070da2..e0d51d5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -21,6 +21,7 @@ on:
         default: false
 
 permissions:
+  actions: read
   contents: read
   statuses: write
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6f5e76..cbf4d11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Replace the mascot banner with contextual Dash artwork connecting framework modules and align README and documentation references. (#9)
 
+### Fixed
+
+- Allow the isolated CI status publisher to read workflow job outcomes without granting write permissions to test jobs.
+
 ## [1.4.0] - 2026-04-25
 
 ### Added