diff --git a/.github/workflows/on-pull-request.yml b/.github/workflows/on-pull-request.yml
index 227d15dcb7..1a2e968ba3 100644
--- a/.github/workflows/on-pull-request.yml
+++ b/.github/workflows/on-pull-request.yml
@@ -39,6 +39,8 @@ jobs:
   lint_docs:
     name: Lint Documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     needs: changes
     if: ${{ needs.changes.outputs.docs == 'true' }}
     steps: