diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index d70936f..7814c30 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -4,21 +4,30 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Trigger BoJ Server (Casket/ssg-mcp)
+        # NOTE: boj-server.local is an mDNS name that cannot resolve from a
+        # GitHub-hosted runner, so this request can only fail here; the
+        # continue-on-error below hides that. Left as-is deliberately —
+        # repairing the syntax is in scope, redesigning the trigger is not.
         run: |
-          # Send a secure trigger to boj-server to build this repository
-          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
+          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\"}"
         continue-on-error: true
-permissions: read-all
-  actions: read
 
-  - name: K9-SVC Validation
-    run: |
-      echo "K9-SVC validation"
-      [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
+      - name: K9-SVC Validation
+        run: |
+          echo "K9-SVC validation"
+          [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
\ No newline at end of file