diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99cae68..a6d3089 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,11 +5,15 @@ on:
     branches: [ main ]
   pull_request:
 
+permissions: { }
+
 jobs:
   build-test:
     name: Build and test
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
 
     services:
       postgres:
@@ -53,6 +57,7 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
+      packages: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3