diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 86b7a12ffe9e..80b66c9dc520 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,4 +1,5 @@
 name: "CodeQL"
+permissions: read-all
 
 on:
   push: