diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9090ca194d8fe0ebe6ae019856982877f64491ce..e4aeee0c9b4985d6293cff2893b6b71c21dd8775 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   rustfmt:
     name: rustfmt