diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e129565..7249d65 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,6 +16,9 @@ on:
   # change.
   # schedule:
   #   - cron: '0 13 * * *'
+permissions:
+  contents: read
+
 jobs:
   build:
     if: contains(github.event.pull_request.labels.*.name, 'safe_to_test')