diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0bd9955..ec787a6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,8 @@ name: CI
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+permissions: read-all
+
 on:
   push:
     branches: [master]