diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 08b3eb3..6520e3d 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -55,12 +55,22 @@ on:
         description: "Prevent the workflow run from failing if/when the job fails"
         required: false
         type: boolean
+      use-documenter-key:
+        description: "Deploy with DOCUMENTER_KEY over SSH instead of GITHUB_TOKEN. Default false: a stale org-level DOCUMENTER_KEY makes Documenter try `git@github.com` and fail even when GITHUB_TOKEN has contents:write."
+        default: false
+        required: false
+        type: boolean
 
 jobs:
   tests:
     name: "Build and Deploy Documentation"
     continue-on-error: ${{ inputs.continue-on-error || inputs.julia-version == 'nightly' }}
     runs-on: ${{ inputs.runner != '' && fromJson(inputs.runner) || (inputs.self-hosted && 'self-hosted' || inputs.os) }}
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      statuses: write
     env:
       # Whether this run has credentials that can actually push to gh-pages. GitHub issues a
       # read-only GITHUB_TOKEN, and withholds secrets such as DOCUMENTER_KEY, for pull
@@ -71,6 +81,8 @@ jobs:
                 && github.actor != 'dependabot[bot]') }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: "Setup Julia ${{ inputs.julia-version }}"
         uses: julia-actions/setup-julia@v3
@@ -95,7 +107,7 @@ jobs:
           # Documenter report `Deploying: ✗` and exit 0, so a fork or Dependabot pull request
           # still reports whether the documentation *builds*, which is all it can verify.
           GITHUB_TOKEN: ${{ env.CAN_DEPLOY_DOCS == 'true' && (inputs.github-token || secrets.GITHUB_TOKEN) || '' }}
-          DOCUMENTER_KEY: ${{ env.CAN_DEPLOY_DOCS == 'true' && (inputs.documenter-key || secrets.DOCUMENTER_KEY) || '' }}
+          DOCUMENTER_KEY: ${{ env.CAN_DEPLOY_DOCS == 'true' && inputs.use-documenter-key && (inputs.documenter-key || secrets.DOCUMENTER_KEY) || '' }}
         run: ${{ inputs.debug-documenter && 'JULIA_DEBUG="Documenter"' || '' }} julia --color=yes --project=docs/ ${{ inputs.coverage && '--code-coverage=user' || '' }} docs/make.jl
 
       - name: "Filter coverage directories to those that exist"