diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 7bf20cf9bea..651ca0d8701 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,8 +16,12 @@ name: PR Verifier
 on:
   pull_request_target:
     types: [opened, edited, reopened]
+permissions: read-all
+
 jobs:
   verify:
+    permissions:
+      checks: write
     name: Verify PR contents
     runs-on: ubuntu-latest
     steps: