diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
index 074aef5c1..3e6fbe1bb 100644
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -14,6 +14,9 @@
 
 name: govulncheck
 
+# Declare default permissions as read only.
+permissions: read-all
+
 on:
   push:
     branches: