diff --git a/code-scanning/clj-holmes.yml b/code-scanning/clj-holmes.yml
index ca53f99..4150cbb 100644
--- a/code-scanning/clj-holmes.yml
+++ b/code-scanning/clj-holmes.yml
@@ -14,6 +14,9 @@ on:
   schedule:
     - cron: $cron-weekly
 
+permissions:
+  contents: read
+  
 jobs:
   clj-holmes:
     name: Run clj-holmes scanning