diff --git a/README.md b/README.md
index b0f6224..64dc025 100644
--- a/README.md
+++ b/README.md
@@ -311,8 +311,17 @@ jobs:
           git commit -m "generated"
           git push
 ```
+
 *NOTE:* The user email is `{user.id}+{user.login}@users.noreply.github.com`. See users API: https://api.github.com/users/github-actions%5Bbot%5D
 
+# Recommended permissions
+
+When using the `checkout` action in your GitHub Actions workflow, it is recommended to set the following `GITHUB_TOKEN` permissions to ensure proper functionality, unless alternative auth is provided via the `token` or `ssh-key` inputs:
+
+```yaml
+permissions:
+  contents: read
+```
 
 # License
 
diff --git a/dist/index.js b/dist/index.js
index b0db713..975842b 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -588,6 +588,8 @@ class GitCommandManager {
     disableSparseCheckout() {
         return __awaiter(this, void 0, void 0, function* () {
             yield this.execGit(['sparse-checkout', 'disable']);
+            // Ensures that a previously enabled 'sparse-checkout' (e.g. via sparseCheckoutNonConeMode) is also disabled in the config.
+            yield this.execGit(['config', 'core.sparseCheckout', 'false']);
             // Disabling 'sparse-checkout` leaves behind an undesirable side-effect in config (even in a pristine environment).
             yield this.tryConfigUnset('extensions.worktreeConfig', false);
         });
diff --git a/src/git-command-manager.ts b/src/git-command-manager.ts
index 8e42a38..a4ed105 100644
--- a/src/git-command-manager.ts
+++ b/src/git-command-manager.ts
@@ -178,6 +178,8 @@ class GitCommandManager {
 
   async disableSparseCheckout(): Promise<void> {
     await this.execGit(['sparse-checkout', 'disable'])
+    // Ensures that a previously enabled 'sparse-checkout' (e.g. via sparseCheckoutNonConeMode) is also disabled in the config.
+    yield this.execGit(['config', 'core.sparseCheckout', 'false']);
     // Disabling 'sparse-checkout` leaves behind an undesirable side-effect in config (even in a pristine environment).
     await this.tryConfigUnset('extensions.worktreeConfig', false)
   }