diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 068a5b1..fcd0fd6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,9 @@ on:
       - 'docs/**'
       - '**/*.md'
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-check:
     runs-on: ubuntu-latest