diff --git a/.github/workflows/pip-tools.yaml b/.github/workflows/pip-tools.yaml
index 243619e2d65..8cf41253cd6 100644
--- a/.github/workflows/pip-tools.yaml
+++ b/.github/workflows/pip-tools.yaml
@@ -11,6 +11,9 @@ on:
     # Run weekly on day 0 at 00:00 UTC
     - cron: "0 0 * * 0"
 
+permissions:
+  contents: read
+
 jobs:
   update-dependencies:
     permissions: