diff --git a/.github/workflows/update-gradle-wrapper.yml b/.github/workflows/update-gradle-wrapper.yml
index 075daa3e0..b32d285b1 100644
--- a/.github/workflows/update-gradle-wrapper.yml
+++ b/.github/workflows/update-gradle-wrapper.yml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Update Gradle Wrapper
 # Needed because dependabot doesn't support updating the gradle wrapper
 # see: https://github.com/dependabot/dependabot-core/issues/2223