diff --git a/.github/workflows/noir-security.yml b/.github/workflows/noir-security.yml
index 5219a29..df443e3 100644
--- a/.github/workflows/noir-security.yml
+++ b/.github/workflows/noir-security.yml
@@ -7,6 +7,8 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
 jobs:
   noir-security:
     name: Run OWASP Noir