diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 2ac1f2ce53..3e553b1c7f 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -7,6 +7,8 @@ on:
     branches:
       - main
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true