diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9c5f282..51cd055 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -10,9 +10,13 @@ concurrency:
   group: validate-demo-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: macos-latest
+    timeout-minutes: 35
     env:
       BASE_CACHE_DIR: ${{ github.workspace }}/.base-cache
       BASE_BASH_LIBS_DIR: ${{ github.workspace }}/.dependencies/base-bash-libs/lib/bash
@@ -194,6 +198,7 @@ jobs:
 
   validate-base-cli-source:
     runs-on: macos-latest
+    timeout-minutes: 25
     env:
       BASE_CACHE_DIR: ${{ github.workspace }}/.base-cache
       BASE_BASH_LIBS_DIR: ${{ github.workspace }}/.dependencies/base-bash-libs/lib/bash
@@ -254,6 +259,7 @@ jobs:
 
   validate-ubuntu:
     runs-on: ubuntu-latest
+    timeout-minutes: 35
     env:
       BASE_CACHE_DIR: ${{ github.workspace }}/.base-cache
       BASE_BASH_LIBS_DIR: ${{ github.workspace }}/.dependencies/base-bash-libs/lib/bash
diff --git a/tests/validate.sh b/tests/validate.sh
index 4c49b12..9143c77 100755
--- a/tests/validate.sh
+++ b/tests/validate.sh
@@ -217,6 +217,7 @@ if [[ -n "$floating_actions_refs" ]]; then
 fi
 
 python3 - <<'PY'
+import re
 from pathlib import Path
 
 workflow = Path(".github/workflows/tests.yml").read_text()
@@ -243,6 +244,22 @@ for job_id in ("validate", "validate-base-cli-source", "validate-ubuntu"):
             ".github/workflows/tests.yml must preserve exactly one stable "
             f"{job_id} job declaration."
         )
+
+if "permissions:\n  contents: read" not in workflow:
+    raise SystemExit(
+        ".github/workflows/tests.yml must declare a read-only contents permission default."
+    )
+
+for job_id in ("validate", "validate-base-cli-source", "validate-ubuntu"):
+    match = re.search(
+        rf"(?ms)^  {re.escape(job_id)}:\n(.*?)(?=^  [A-Za-z0-9_-]+:|\Z)",
+        workflow,
+    )
+    if match is None or re.search(r"(?m)^    timeout-minutes:\s*[1-9][0-9]*\s*$", match.group(1)) is None:
+        raise SystemExit(
+            ".github/workflows/tests.yml must give every validation job an explicit positive timeout: "
+            f"{job_id}."
+        )
 PY
 
 grep -Fq 'pull_request_target:' .github/workflows/issue-branch-policy.yml || {