diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f59c0560ba..758a4b729b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -10,6 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write