diff --git a/ci/deno.yml b/ci/deno.yml
index 25e9e2a..6393f5f 100644
--- a/ci/deno.yml
+++ b/ci/deno.yml
@@ -14,6 +14,9 @@ on:
   pull_request:
     branches: [$default-branch]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest