diff --git a/code-scanning/dependency-review.yml b/code-scanning/dependency-review.yml
index c342269..eb3a90b 100644
--- a/code-scanning/dependency-review.yml
+++ b/code-scanning/dependency-review.yml
@@ -7,6 +7,9 @@
 name: 'Dependency Review'
 on: [pull_request]
 
+permissions:
+  repo: read
+
 jobs:
   dependency-review:
     runs-on: ubuntu-latest