diff --git a/code-scanning/clj-holmes.yml b/code-scanning/clj-holmes.yml
index 62364b3..704a01e 100644
--- a/code-scanning/clj-holmes.yml
+++ b/code-scanning/clj-holmes.yml
@@ -13,6 +13,8 @@ on:
     branches: [ $default-branch ]
   schedule:
     - cron: $cron-weekly
+permissions:
+  contents: read
 
 jobs:
   clj-holmes: