diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 29479af..8f39355 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,8 @@
 #
 name: "CodeQL"
 
+permissions: read-all
+
 on:
   push:
     branches: [ "master" ]