diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index d0cb8ba..fe5b5c4 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -11,6 +11,8 @@ env:
 jobs:
   test-and-build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     env:
       PIP_PROGRESS_BAR: "off"