diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 300f765..53e8d53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,5 @@
 name: ci
+permissions: read-all
 on:
   push:
     branches: [ main ]
@@ -24,6 +25,9 @@ jobs:
   build:
     runs-on: ${{ matrix.os }}
     needs: cpplint
+    permissions:
+      contents: read
+      actions: write
     strategy:
       matrix:
         os: [ ubuntu-24.04, windows-2022 ]