diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7a4426..14bd8e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 # Cancel superseded runs on the same ref to save CI minutes. Unlike the release
 # workflow, an interrupted CI run has no side effects.
 concurrency: