diff --git a/.github/workflows/build_and_test_pr.yml b/.github/workflows/build_and_test_pr.yml
index 5a1beee2..c427e98c 100644
--- a/.github/workflows/build_and_test_pr.yml
+++ b/.github/workflows/build_and_test_pr.yml
@@ -1,4 +1,6 @@
 name: Build and test PRs pushed to osctrl
+permissions:
+  contents: read
 
 on: [push, pull_request]