diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 3e92dd54f..7a7c6393c 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -73,6 +73,8 @@ on:
     types:
       - 'created'
 
+permissions: {}
+
 jobs:
   spelling:
     name: Check Spelling
@@ -92,7 +94,7 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@v0.0.24
+        uses: check-spelling/check-spelling@v0.0.26
         with:
           suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
           checkout: true
@@ -127,11 +129,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: spelling
     permissions:
+      actions: read
       contents: write
     if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@v0.0.24
+        uses: check-spelling/check-spelling@v0.0.26
         with:
           checkout: true
           spell_check_this: check-spelling/spell-check-this@prerelease
@@ -143,12 +146,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: spelling
     permissions:
+      actions: read
       contents: read
       pull-requests: write
     if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
     steps:
       - name: comment
-        uses: check-spelling/check-spelling@v0.0.24
+        uses: check-spelling/check-spelling@v0.0.26
         with:
           checkout: true
           spell_check_this: check-spelling/spell-check-this@prerelease
@@ -175,8 +179,8 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: apply spelling updates
-        uses: check-spelling/check-spelling@v0.0.24
+        uses: check-spelling/check-spelling@v0.0.26
         with:
           experimental_apply_changes_via_bot: 1
           checkout: true
-          ssh_key: "${{ secrets.CHECK_SPELLING }}"
\ No newline at end of file
+          ssh_key: "${{ secrets.CHECK_SPELLING }}"