diff --git a/.github/workflows/enforce-pullrequest-rules.yaml b/.github/workflows/enforce-pullrequest-rules.yaml
index aa4d51beb9..aa3973cfbc 100644
--- a/.github/workflows/enforce-pullrequest-rules.yaml
+++ b/.github/workflows/enforce-pullrequest-rules.yaml
@@ -3,6 +3,9 @@
 
 name: "Enforce Pull-Request Rules"
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push: