diff --git a/.forgejo/workflows/prefligit-checks.yml b/.forgejo/workflows/prefligit-checks.yml
index 84bbac1f..08c93d12 100644
--- a/.forgejo/workflows/prefligit-checks.yml
+++ b/.forgejo/workflows/prefligit-checks.yml
@@ -3,6 +3,8 @@ name: Checks / Prefligit
 on:
   push:
   pull_request:
+permissions:
+  contents: read
 
 jobs:
   prefligit: