diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index 6bacdc8..456889d 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -22,6 +22,8 @@ jobs:
   check-run:
     name: Check PR run
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions:
+      contents: read
 
   sast:
     name: SAST scan