diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml
index d24240d..6fdadb1 100644
--- a/code-scanning/codeql.yml
+++ b/code-scanning/codeql.yml
@@ -33,6 +33,9 @@ jobs:
       # required for all workflows
       security-events: write
 
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
       # only required for workflows in private repositories
       actions: read
       contents: read