diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 349c7d8b..c17d397a 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -11,7 +11,8 @@ on:  # yamllint disable-line rule:truthy
 env:
   FORCE_COLOR: "1"  # Make tools pretty.
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   test: