diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index c821e5a..9eb67a3 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -9,6 +9,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 name: Semgrep config
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep/ci