diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index cf94890a5..2f504e4ef 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -3,6 +3,8 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 0 * * *'
+permissions:
+  contents: read
 jobs:
   main:
     runs-on: ubuntu-latest