diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fab84e13..ee6209f2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,6 +4,9 @@ on:
     pull_request:
         branches: ['main']
 
+permissions:
+    contents: read
+
 env:
     NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}