diff --git a/.github/workflows/check-manifest-generation-diff.yaml b/.github/workflows/check-manifest-generation-diff.yaml
index d44053d..71eee9e 100644
--- a/.github/workflows/check-manifest-generation-diff.yaml
+++ b/.github/workflows/check-manifest-generation-diff.yaml
@@ -3,6 +3,9 @@ name: Check for diff after manifest and generated targets
 on:
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check for diff