diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c18be9d..b7dcc2d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,4 +1,6 @@
 name: Tests
+permissions:
+  contents: read
 
 # This workflow runs standard unit tests to ensure basic integrity and avoid
 # regressions on pull-requests (and pushes)