diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ec51ca30..898f8c025 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,8 @@ name: CI pipeline
 
 on: [ push, pull_request, workflow_dispatch ]
 
+permissions: read-all
+
 jobs:
   build:
     name: "Build ${{ matrix.os }} node${{ matrix.node-version }}"