diff --git a/.gitea/workflows/changes.yaml b/.gitea/workflows/changes.yaml
index 7102848..01ced07 100644
--- a/.gitea/workflows/changes.yaml
+++ b/.gitea/workflows/changes.yaml
@@ -7,6 +7,9 @@ on:
       client:
         value: ${{ jobs.changes.outputs.client }}
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     name: filter