diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 009a4f8..0e6fa12 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -2,6 +2,8 @@ name: Tests
 on: [push]
 jobs:
   tests:
+    permissions:
+      contents: read
     strategy:
       matrix:
         env: