diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b5bc9a4..3c1db80 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -4,6 +4,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: ${{ matrix.name }}