diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index fb11639..977f354 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -3,6 +3,8 @@ on:
   schedule:
     - cron: '0 6 * * *'
 name: Semgrep config
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep/ci