diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index bb87ac077bc..4d5040fb600 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -10,7 +10,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 env:
   VSCODE_QUALITY: 'oss'