diff --git a/.github/workflows/ci-merge-coverage.yaml b/.github/workflows/ci-merge-coverage.yaml
index eb0048b3f8..bceb08d8d6 100644
--- a/.github/workflows/ci-merge-coverage.yaml
+++ b/.github/workflows/ci-merge-coverage.yaml
@@ -6,6 +6,9 @@ on:
     types:
       - completed
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   merge-coverage-files:
     name: Download and merge files
@@ -74,4 +77,4 @@ jobs:
 
       - uses: codecov/codecov-action@v4
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
\ No newline at end of file
+          token: ${{ secrets.CODECOV_TOKEN }}