diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 132655087b..cbf55a1716 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,6 +7,8 @@ on:
   pull_request:
     branches:
       - "*"
+permissions:
+  contents: read
 
 defaults:
   run:
diff --git a/docs/release-notes/release-notes-0.14.0.md b/docs/release-notes/release-notes-0.14.0.md
index 53c988b566..ce33a358a8 100644
--- a/docs/release-notes/release-notes-0.14.0.md
+++ b/docs/release-notes/release-notes-0.14.0.md
@@ -239,6 +239,8 @@ you.
 
 * [Upgraded miekg/dns to improve the security posture](https://github.com/lightningnetwork/lnd/pull/5738)
 
+* [Restricted permissions to GitHub main action](https://github.com/lightningnetwork/lnd/pull/5744)
+
 ## Database
 
 * [Ensure single writer for legacy