diff --git a/.github/workflows/ninja-build.yml b/.github/workflows/ninja-build.yml
index cdb6e7df10a..d27fff46bf2 100644
--- a/.github/workflows/ninja-build.yml
+++ b/.github/workflows/ninja-build.yml
@@ -19,6 +19,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   build: