diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9e6f0ed..39d9553 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -92,6 +92,7 @@ jobs:
     runs-on: ubuntu-24.04
     needs: [build]
     if: ${{ !cancelled() }}
+    permissions: {}
     steps:
       - name: Successful verification
         if: ${{ !(contains(needs.*.result, 'failure')) }}