diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8f68ad6cb..f1c729934 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -2,6 +2,8 @@ name: Run checks
 
 on: [push]
 
+permissions: read
+
 env:
   NOTIFY_ENVIRONMENT: test
   NEW_RELIC_CONFIG_FILE: newrelic.ini