diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8fc0b023a..54deeb6eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,7 @@
 name: "Continuous Integration"
 on: [push, pull_request]
+permissions:
+  contents: read
 
 jobs:
   validation:
@@ -47,4 +49,4 @@ jobs:
       uses: gradle/actions/setup-gradle@v3
     
     - name: Run copyright and code format checks
-      run: ./gradlew --no-daemon spotlessCheck
\ No newline at end of file
+      run: ./gradlew --no-daemon spotlessCheck