diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 556cadf..2975465 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
           nix_version: 2.31.2
       - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1
       - run: deno task build
-      - run: deno test --allow-read
+      - run: deno test -P
   typecheck:
     name: Check TypeScript
     runs-on: ubuntu-24.04
diff --git a/deno.json b/deno.json
index 792d0e5..557fe6d 100644
--- a/deno.json
+++ b/deno.json
@@ -14,7 +14,11 @@
     "exclude": ["!src/main.wasm", "!src/wasm_exec.js"]
   },
   "tasks": {
-    "build": "deno run --allow-env --allow-read --allow-run --allow-write build.ts",
-    "test": "deno test --allow-read"
+    "build": "deno run --allow-env --allow-read --allow-run --allow-write build.ts"
+  },
+  "test": {
+    "permissions": {
+      "read": ["src/main.wasm", "tests/publiccode.yml"]
+    }
   }
 }
diff --git a/tests/mod_test.ts b/tests/mod_test.ts
index 78dff5e..9c2159a 100644
--- a/tests/mod_test.ts
+++ b/tests/mod_test.ts
@@ -5,8 +5,7 @@ import { initializeWasm, validator } from "../src/validator.ts";
 await initializeWasm();
 
 Deno.test("Simple test", async () => {
-  const path = new URL("./publiccode.yml", import.meta.url);
-  const publicCodeYaml = await Deno.readTextFile(path);
+  const publicCodeYaml = await Deno.readTextFile("tests/publiccode.yml");
 
   const res = await validator({ publiccode: publicCodeYaml });