diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ff0e51..4758872 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ permissions: {}
 jobs:
   ci:
     name: CI
+    permissions:
+      pull-requests: read
+      contents: read
     uses: silverstripe/gha-ci/.github/workflows/ci.yml@v1
     permissions:
       pull-requests: read