diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1178ca..3f7565f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,5 +8,7 @@ on:
 
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      contents: read
     uses: rubyatscale/shared-config/.github/workflows/ci.yml@main
     secrets: inherit