diff --git a/.github/workflows/clang-tidy.yaml b/.github/workflows/clang-tidy.yaml
index 2f64169ce3..2b00d8dcdf 100644
--- a/.github/workflows/clang-tidy.yaml
+++ b/.github/workflows/clang-tidy.yaml
@@ -8,6 +8,8 @@ on:
 
 jobs:
   clang-tidy:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4