diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d7e46bc..6c2775b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,10 @@ env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: full
   CI: true
+
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   Test:
     runs-on: ${{ matrix.os }}