diff --git a/.github/workflows/org-zizmor.yml b/.github/workflows/org-zizmor.yml
index cc627e3738..8510fd85b4 100644
--- a/.github/workflows/org-zizmor.yml
+++ b/.github/workflows/org-zizmor.yml
@@ -10,4 +10,6 @@ jobs:
     name: Zizmor
     uses: immich-app/devtools/.github/workflows/shared-zizmor.yml@main
     permissions:
-      pull-requests: write
+      actions: read
+      contents: read
+      security-events: write