diff --git a/.github/workflows/ufuzz.yml b/.github/workflows/ufuzz.yml
index 43b6ed55..37601abf 100644
--- a/.github/workflows/ufuzz.yml
+++ b/.github/workflows/ufuzz.yml
@@ -11,6 +11,10 @@ on:
 env:
   BASE_URL: https://api.github.com/repos/${{ github.repository }}
   TOKEN: ${{ github.token }}
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   ufuzz:
     strategy: