diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffc478b..aab01af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,10 @@ on:
         options: [preview, production]
         default: preview
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   ci:
     name: Lint, Typecheck, Test & Build