diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 914efbcac..0c787620a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,4 +1,5 @@
 name: Continuous Integration
+permissions: read-all
 
 on:
   push:
@@ -36,4 +37,4 @@ jobs:
             docker rm $(docker ps -q --filter ancestor=native-sdk-ubuntu)
           fi
           rm container_id.out
-          rm git_sha.out
\ No newline at end of file
+          rm git_sha.out