diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml
index 01502b1..3204671 100644
--- a/.github/workflows/blank.yml
+++ b/.github/workflows/blank.yml
@@ -2,6 +2,9 @@
 
 name: CI
 
+permissions:
+  contents: read
+
 # Controls when the workflow will run
 on:
   # Triggers the workflow on push or pull request events but only for the "main" branch