diff --git a/.github/workflows/black.yaml b/.github/workflows/black.yaml
index 94c22ea57d..146c3beba3 100644
--- a/.github/workflows/black.yaml
+++ b/.github/workflows/black.yaml
@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-24.04