diff --git a/.github/workflows/pr-workflow.yaml b/.github/workflows/pr-workflow.yaml
index f2a31ab9..91b0f6c0 100644
--- a/.github/workflows/pr-workflow.yaml
+++ b/.github/workflows/pr-workflow.yaml
@@ -1,16 +1,15 @@
 name: 🏷️ JIRA ID Validator
 
 on:
-  # Using pull_request_target instead of pull_request to handle PRs from forks
-  pull_request_target:
+  pull_request:
     types: [opened, edited, reopened, synchronize]
-    # No branch filtering - will run on all PRs
+
+permissions:
+  contents: read
 
 jobs:
   jira-pr-check:
     name: 🏷️ Validate JIRA ticket ID
-    # Use the reusable workflow from the central repository
     uses: marklogic/pr-workflows/.github/workflows/jira-id-check.yml@main
     with:
-      # Pass the PR title from the event context
       pr-title: ${{ github.event.pull_request.title }}