diff --git a/code-scanning/anchore.yml b/code-scanning/anchore.yml
index 6f52d5d..5c19cc3 100644
--- a/code-scanning/anchore.yml
+++ b/code-scanning/anchore.yml
@@ -28,6 +28,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # for github/codeql-action/upload-sarif to get Action run status
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code