diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ca5462ad790..4f38aea07d48 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.actor }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions:
+  contents: read  # for actions/checkout to fetch code  
 jobs:
   golangci:
     name: lint