diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 70a17b71d0..2e2688f940 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -9,6 +9,9 @@ on:
     push:
         branches: [ master, stable-* ]
 
+permissions:
+    contents: read
+
 jobs:
     check:
         runs-on: ubuntu-latest