diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml
index 297fa38359..753533e75e 100644
--- a/.github/workflows/github-actions.yml
+++ b/.github/workflows/github-actions.yml
@@ -18,6 +18,10 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+
+permissions:
+  contents: read
+
 jobs:
   # ============================================================
   # Per-group unit-test jobs.