diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 6b65dbf0..3ba2b9d6 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -5,6 +5,10 @@ on:
     paths:
       - 'CHANGELOG.md'
 
+
+permissions:
+  contents: read
+
 jobs:
   changelog:
     uses: cockroachdb/actions/.github/workflows/pr-changelog-check.yml@v0