diff --git a/code-scanning/contrast-scan.yml b/code-scanning/contrast-scan.yml
index e822508..61ffd7a 100644
--- a/code-scanning/contrast-scan.yml
+++ b/code-scanning/contrast-scan.yml
@@ -21,6 +21,9 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 name: Scan analyze workflow
 jobs:
   build-and-scan: