diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e8bf0b5..8a45da8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,6 +11,8 @@
 #
 
 name: CI
+permissions:
+    contents: read
 
 on:
   pull_request:
diff --git a/src/PHPUnit/TraitGithubActions.php b/src/PHPUnit/TraitGithubActions.php
index 47918b3..6a86c97 100644
--- a/src/PHPUnit/TraitGithubActions.php
+++ b/src/PHPUnit/TraitGithubActions.php
@@ -35,8 +35,11 @@ public static function testGithubActionsWorkflow(): void
 
         // Expected
         $expected = [
-            'name' => 'CI',
-            'on'   => [
+            'name'        => 'CI',
+            'permissions' => [
+                'contents' => 'read',
+            ],
+            'on' => [
                 'pull_request' => ['branches' => ['*']],
                 'push'         => ['branches' => ['master']],
             ],