diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml
index 457772a..90431f0 100644
--- a/.github/workflows/rector.yml
+++ b/.github/workflows/rector.yml
@@ -10,6 +10,8 @@ on:
       - 'psalm.xml'
 
 name: rector
+permissions:
+  contents: read
 
 jobs:
   rector: