diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 9d4db63..a0d9ffe 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -22,6 +22,8 @@ env:
 jobs:
   dist:
     name: Distribution build
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps: