diff --git a/.github/workflows/pgsql.yml b/.github/workflows/pgsql.yml
index 677dfd6..5546339 100644
--- a/.github/workflows/pgsql.yml
+++ b/.github/workflows/pgsql.yml
@@ -21,6 +21,8 @@ on:
       - 'psalm.xml'
 
 name: pgsql
+permissions:
+  contents: read
 
 jobs:
   tests: