diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index b9e89fc5f..dcb7ce590 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -15,6 +15,9 @@ on:
       - "deploy/**"
       - ".github/workflows/smoke.yml"
 
+permissions:
+  contents: read
+
 jobs:
   noninteractive-install:
     strategy: