diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 8cb675f..4c9ab97 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -8,5 +8,7 @@ on:
 
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      contents: write
     uses: rubyatscale/shared-config/.github/workflows/cd.yml@main
     secrets: inherit
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 0287d52..2696450 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -5,4 +5,7 @@ on:
     - cron: '0 0 * * *'
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
+      pull-requests: write
     uses: rubyatscale/shared-config/.github/workflows/stale.yml@main
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 74bb1d9..7c492ee 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -6,4 +6,6 @@ on:
       - opened
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
     uses: rubyatscale/shared-config/.github/workflows/triage.yml@main
diff --git a/lib/packwerk/privacy/checker.rb b/lib/packwerk/privacy/checker.rb
index bf1f78e..406e785 100644
--- a/lib/packwerk/privacy/checker.rb
+++ b/lib/packwerk/privacy/checker.rb
@@ -12,7 +12,7 @@ class Checker
 
       VIOLATION_TYPE = 'privacy'
       PUBLICIZED_SIGIL = 'pack_public: true'
-      PUBLICIZED_SIGIL_REGEX = /#.*pack_public:\s*true/
+      PUBLICIZED_SIGIL_REGEX = /pack_public:\s*true/
       @publicized_locations = {} #: Hash[String, bool]
 
       class << self
@@ -35,7 +35,14 @@ def check_for_publicized_sigil(location)
 
         #: (Array[String] lines) -> bool
         def content_contains_sigil?(lines)
-          lines.first(5).any? { |l| l =~ PUBLICIZED_SIGIL_REGEX }
+          lines.first(5).any? do |l|
+            # Only the sigil's existence matters, so it is enough to look for it after the
+            # line's first `#`. Searching from there keeps the scan linear in the length of
+            # the line, where matching `/#.*pack_public:\s*true/` would retry the `.*` scan
+            # once per `#` in the line.
+            comment_start = l.index('#')
+            !comment_start.nil? && PUBLICIZED_SIGIL_REGEX.match?(l, comment_start + 1)
+          end
         end
       end
 
diff --git a/test/unit/privacy/checker_test.rb b/test/unit/privacy/checker_test.rb
index 762e2a8..718aa86 100644
--- a/test/unit/privacy/checker_test.rb
+++ b/test/unit/privacy/checker_test.rb
@@ -154,6 +154,7 @@ class CheckerTest < Minitest::Test
           ['line 1', 'line 2', 'line 3', 'line 4', '# pack_public: true'],
           ['#pack_public:true', 'line 2', 'line 3'],
           ['line 1', '#       pack_public:         true'],
+          ['# typed: strict # pack_public: true'],
         ]
         content_with_invalid_or_missing_sigils = [
           ['line 1', 'line 2', 'line 3', 'line 4', 'line 5', '# pack_public: true'],
@@ -161,6 +162,8 @@ class CheckerTest < Minitest::Test
           ['line 1', '#       pack_public:         false'],
           ['# pack_public: false', 'line 2', 'line 3'],
           ['line 1', 'EOF'],
+          ['pack_public: true'],
+          ['pack_public: true # not the sigil'],
         ]
         assert(content_with_valid_sigils.all? { |content| Privacy::Checker.content_contains_sigil?(content) })
         assert(content_with_invalid_or_missing_sigils.none? { |content| Privacy::Checker.content_contains_sigil?(content) })