diff --git a/.github/workflows/echo.yml b/.github/workflows/echo.yml
index e35e7f107..7a2db7a9a 100644
--- a/.github/workflows/echo.yml
+++ b/.github/workflows/echo.yml
@@ -21,6 +21,9 @@ on:
       - 'codecov.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   test:
     strategy: