diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 3258402..c2ded4f 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -1,6 +1,11 @@
 ---
 name: "CodeQL"
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 # yamllint disable-line rule:truthy
 on:
   pull_request: