diff --git a/.github/workflows/deploy-railway.yml b/.github/workflows/deploy-railway.yml
index 2c3edc1d2..57bd75650 100644
--- a/.github/workflows/deploy-railway.yml
+++ b/.github/workflows/deploy-railway.yml
@@ -1,5 +1,7 @@
 name: Deploy to Railway
 
+permissions: {}
+
 on:
   workflow_run:
     workflows: ["Release Sourcebot (Development)"]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 454eebecd..7f222c2c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Fixed revision selection so the 64-revision cap prefers the newest matching branches and tags instead of pruning by ref-name order. [#1122](https://github.com/sourcebot-dev/sourcebot/pull/1122)
 - Fixed infinite pagination loop in Gitea/Forgejo when an API token can only see a subset of org repos (the `x-total-count` header reports org total while token returns fewer items). [#1130](https://github.com/sourcebot-dev/sourcebot/pull/1130)
+- Fixed CodeQL missing-workflow-permissions alert by adding explicit empty permissions to `deploy-railway.yml`. [#1132](https://github.com/sourcebot-dev/sourcebot/pull/1132)
 
 ## [4.16.11] - 2026-04-17