diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec1ef041b20..9ebbc9c1c4b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,6 +25,8 @@ name: CI
   pull_request:
     branches:
       - "**"
+permissions:
+  contents: read
 defaults:
   run:
     shell: bash