diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d819a7f..1bc1904 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -173,6 +173,9 @@ jobs:
     outputs:
       latest_local_sha: ${{ steps.output-sha.outputs.latest_local_sha }}
 
+    permissions:
+      contents: read
+
     steps:
 
       - name: Checkout code