diff --git a/.github/workflows/prod_tests.yaml b/.github/workflows/prod_tests.yaml
index ab96712d5..6cbff2587 100644
--- a/.github/workflows/prod_tests.yaml
+++ b/.github/workflows/prod_tests.yaml
@@ -8,6 +8,9 @@ on:
   #   branches:
   #     - trunk
 
+permissions:
+  contents: read
+
 env:
   SSHNP_ATSIGN: "@8incanteater"
   SSHNPD_ATSIGN: "@8052simple"