diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 0c389112..c4dd833a 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -2,6 +2,8 @@ name: go
 on:
   push:
   pull_request:
+permissions:
+  contents: read
 jobs:
   verify: # <- name
     strategy: