diff --git a/.github/workflows/golang-analysis.yml b/.github/workflows/golang-analysis.yml
index 3a74e61a2..b9476f94e 100644
--- a/.github/workflows/golang-analysis.yml
+++ b/.github/workflows/golang-analysis.yml
@@ -1,6 +1,9 @@
 on: [push, pull_request]
 name: Go Checks
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   unit:
     runs-on: ubuntu-latest