diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 928c838..7181c5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,8 @@ on:
     branches:
       - main
       - "releases/*"
+permissions:
+  contents: read
 
 jobs:
   build-lint-test:
@@ -67,4 +69,4 @@ jobs:
 
       - name: Check format age-estimation
         run: dotnet format --verify-no-changes
-        working-directory: samples/age-estimation/Worker
\ No newline at end of file
+        working-directory: samples/age-estimation/Worker