diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d94d0ef33..cc6a1b74f 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -11,6 +11,10 @@ defaults:
 concurrency:
   group: doc-${{github.ref}}
   cancel-in-progress: true
+permissions:
+  contents: read
+  pages: write
+  id-token: write
 jobs:
   build:
     name: Build documentation
@@ -27,6 +31,7 @@ jobs:
           environment-file: docs/environment.yml
           environment-name: lkpy
           init-shell: bash
+          cache-environment: true
       - id: install
         name: 🍱 Install LensKit packages
         run: |
diff --git a/lkdev/workflows/docs.py b/lkdev/workflows/docs.py
index ee3811d5c..0e8f98f6e 100644
--- a/lkdev/workflows/docs.py
+++ b/lkdev/workflows/docs.py
@@ -23,6 +23,11 @@ def workflow():
             "group": "doc-${{github.ref}}",
             "cancel-in-progress": True,
         },
+        "permissions": {
+            "contents": "read",
+            "pages": "write",
+            "id-token": "write",
+        },
         "jobs": {
             "build": job_build_docs(),
             "archive": job_archive_docs(),
@@ -52,6 +57,7 @@ def stages_setup():
                 "environment-file": "docs/environment.yml",
                 "environment-name": "lkpy",
                 "init-shell": "bash",
+                "cache-environment": True,
             },
         },
         {