diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 61a266e..63614cc 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.workflow }}-ci-${{ github.event.number || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   tests:
     name: Tests