diff --git a/.github/workflows/lint-openapi.yml b/.github/workflows/lint-openapi.yml
index d62d3e9d..817e94b9 100644
--- a/.github/workflows/lint-openapi.yml
+++ b/.github/workflows/lint-openapi.yml
@@ -7,6 +7,10 @@ on:
     paths:
       - 'docs/**'
 
+# This action only needs read permissions
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest