diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index adf66db..3c4b0aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ on:
   # Allow manually triggering the workflow.
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   xmllint:
     # Don't run the cron job on forks.