diff --git a/.github/workflows/webserver.yml b/.github/workflows/webserver.yml
index 46ce27624..9bebbd5ee 100644
--- a/.github/workflows/webserver.yml
+++ b/.github/workflows/webserver.yml
@@ -199,6 +199,8 @@ jobs:
 
 
   Codeql-build:
+    permissions:
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
     name: static-analysis
     runs-on: ubuntu-20.04
     steps: