diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cd4cdfbe9..a26660f00 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,6 +26,9 @@ on:
       - master
       - v0.23.x
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   build-linux:
     strategy: