diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 645e586..e6ad28c 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -7,6 +7,9 @@ on:
 
   pull_request:
 
+# see https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest