diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml
index 6f245c28..54a5017a 100644
--- a/.github/workflows/gosec.yml
+++ b/.github/workflows/gosec.yml
@@ -1,6 +1,10 @@
 name: CI gosec
 permissions:
+  # required for all workflows
+  security-events: write
+  # only required for workflows in private repositories
   actions: read
+  contents: read
 on:
   push:
     branches: [ "*" ]