diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 3876f8f..b7aabc4 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -12,6 +12,9 @@ concurrency:
   group: integration-tests-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   DOTNET_ENVIRONMENT: ci
   PROJECT: src/Grillisoft.Tools.DatabaseDeploy.Cli/Grillisoft.Tools.DatabaseDeploy.Cli.csproj