diff --git a/.github/workflows/publish-to-maven-central.yml b/.github/workflows/publish-to-maven-central.yml
index b5c6d8a..a155f8d 100644
--- a/.github/workflows/publish-to-maven-central.yml
+++ b/.github/workflows/publish-to-maven-central.yml
@@ -1,6 +1,8 @@
 # .github/workflows/publish-to-maven-central.yml
 
 name: Publish to Maven Central
+permissions:
+  contents: read
 on:
   release:
     types: [released]