diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml
index f8facc0453ca..db0525781dd0 100644
--- a/.github/workflows/dependency-graph.yml
+++ b/.github/workflows/dependency-graph.yml
@@ -3,6 +3,8 @@ on:
   push:
     branches:
       - main # default branch of the project
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   dependency-graph:
     name: Update Dependency Graph