diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 76e0c1c11..1d7237c5b 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -9,6 +9,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   push_to_registry:
     if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'