diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4c6b3e8..3d7b8c3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,8 @@
 
 name: CI
 
+permissions: read-all
+
 # Controls when the workflow will run
 on:
   # Triggers the workflow on push or pull request events but only for the "devel" branch