diff --git a/code-scanning/sysdig-scan.yml b/code-scanning/sysdig-scan.yml
index 49841d7..f9b29fc 100644
--- a/code-scanning/sysdig-scan.yml
+++ b/code-scanning/sysdig-scan.yml
@@ -13,10 +13,17 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
 
+    permissions:
+      checks: write # for sysdiglabs/scan-action to publish the checks
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:
@@ -51,4 +58,4 @@ jobs:
       #Upload SARIF file
       if: always()
       with:
-        sarif_file: ${{ steps.scan.outputs.sarifReport }}
\ No newline at end of file
+        sarif_file: ${{ steps.scan.outputs.sarifReport }}