diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d965fc2..fec5890 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,8 @@ jobs:
   checks:
     name: Check Python ${{ matrix.python-version }} on ${{ matrix.runs-on }}
     runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     needs: [pre-commit]
     strategy:
       fail-fast: false