diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 8fa2a56e4..a08ecf16e 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -120,6 +120,9 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
 
     steps: