diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 30eae40e89d..64b9a8bb073 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -7,11 +7,12 @@ on:
   pull_request:
 
 permissions:
-  security-events: write
   contents: read
 
 jobs:
   CodeQL-Build:
+    permissions:
+      security-events: write
     runs-on: ubuntu-latest
 
     steps: