diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8444fe8..10cd779 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,8 +1,9 @@
-name: CodeQL Security Analysis
+name: "CodeQL Security Analysis"
 
 on:
   push:
     branches: [ main ]
+  # Use pull_request_target to run in the base repo context (allows required permissions)
   pull_request_target:
     types: [opened, synchronize, reopened]
   schedule:
@@ -17,6 +18,8 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
 
     strategy:
       fail-fast: false
@@ -24,11 +27,12 @@ jobs:
         language: ['python']
 
     steps:
-      - name: Checkout repository
+      - name: Checkout repository (base repo context)
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3