diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml
index c576a54877..a1273a8a73 100644
--- a/.github/workflows/publish-changelog.yml
+++ b/.github/workflows/publish-changelog.yml
@@ -9,6 +9,9 @@ on:
         description: "The branch to target"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   publish_changelog:
     runs-on: ubuntu-latest