diff --git a/deployments/terraform.yml b/deployments/terraform.yml
index 589f1f3..b7cbc3a 100644
--- a/deployments/terraform.yml
+++ b/deployments/terraform.yml
@@ -50,6 +50,9 @@ on:
     - $default-branch
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   terraform:
     name: 'Terraform'