diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 624c7fd..7853bc6 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -1,5 +1,8 @@
 name: Alt Sources Dry Run
 
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 2 * * *'  # Supplemental early-morning verification