diff --git a/.github/workflows/publish-canaries.yml b/.github/workflows/publish-canaries.yml
index 6ceb6385a7dfbf..fd137f48bf7c1d 100644
--- a/.github/workflows/publish-canaries.yml
+++ b/.github/workflows/publish-canaries.yml
@@ -3,6 +3,8 @@ name: Publish canary packages to npm
 on:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest