diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 294ebb2..c477b03 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,6 +8,8 @@ name: Build test
   pull_request:
     branches:
       - main
+permissions:
+  contents: read
 
 # ensure that the workflow is only triggered once per PR,  subsequent pushes to the PR will cancel
 # and restart the workflow. See https://docs.github.com/en/actions/using-jobs/using-concurrency