diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
index b7cd306..03be1d5 100644
--- a/.github/workflows/pr-checks.yaml
+++ b/.github/workflows/pr-checks.yaml
@@ -6,6 +6,9 @@ on:
       - main
       - v12
 
+permissions:
+  contents: read
+
 jobs:
   backend-test:
     name: Backend tests
diff --git a/frontend/projects/plugin/src/lib/components/graph-mail-configuration/graph-mail-configuration.component.ts b/frontend/projects/plugin/src/lib/components/graph-mail-configuration/graph-mail-configuration.component.ts
index 4b4a4e7..4d9ada5 100644
--- a/frontend/projects/plugin/src/lib/components/graph-mail-configuration/graph-mail-configuration.component.ts
+++ b/frontend/projects/plugin/src/lib/components/graph-mail-configuration/graph-mail-configuration.component.ts
@@ -59,7 +59,7 @@ export class GraphMailPluginConfigurationComponent
 
   // Aligned with the backend EMAIL_REGEX in GraphMailValidation.kt — keep in sync.
   private static readonly EMAIL_RE =
-    /^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9][a-zA-Z0-9.\-]*\.[a-zA-Z]{2,}$/;
+    /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9][a-zA-Z0-9.-]*\.[a-zA-Z]{2,}$/;
 
   // Azure Tenant IDs and Client IDs are always GUIDs.
   private static readonly UUID_RE =