diff --git a/.github/workflows/qa.yaml b/.github/workflows/qa.yaml
index f33bfa50f..f61461806 100644
--- a/.github/workflows/qa.yaml
+++ b/.github/workflows/qa.yaml
@@ -37,6 +37,8 @@ jobs:
             needs-flutter: true
 
     runs-on: ${{ matrix.os }}-latest
+    permissions:
+      contents: read
     steps:
       - name: Set up git
         # This step needs to be done before checkout so that the checkout respects clrf
@@ -64,8 +66,9 @@ jobs:
         run: |
           dart pub global activate protoc_plugin
       - name: Quality check
-        uses: canonical/desktop-engineering/gh-actions/go/code-sanity@main
+        uses: canonical/desktop-engineering/gh-actions/go/code-sanity@setup-grpc-github-token
         with:
+          github-token: ${{ github.token}}
           working-directory: ${{ matrix.subproject }}
           go-tags: gowslmock
           tools-directory: ${{ github.workspace }}/tools