diff --git a/code-scanning/trivy.yml b/code-scanning/trivy.yml
index 307950e..3d5373f 100644
--- a/code-scanning/trivy.yml
+++ b/code-scanning/trivy.yml
@@ -14,7 +14,8 @@ on:
   schedule:
     - cron: $cron-weekly
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build: