diff --git a/README.md b/README.md
index 5b70c582..c2805f00 100644
--- a/README.md
+++ b/README.md
@@ -152,6 +152,9 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # Allow comments on PRs
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v3
diff --git a/command/README.md b/command/README.md
index 82eadd57..8d0a814c 100644
--- a/command/README.md
+++ b/command/README.md
@@ -66,6 +66,7 @@ jobs:
     if: ${{ github.event.issue.pull_request }}
     # Allow the bot to comment on pulls
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: 🏗 Setup repo
diff --git a/preview-comment/README.md b/preview-comment/README.md
index f141b1af..9e7251cb 100644
--- a/preview-comment/README.md
+++ b/preview-comment/README.md
@@ -96,6 +96,7 @@ jobs:
   preview:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write # Allow comments on PRs
     steps:
       - name: 🏗 Setup repo
@@ -141,6 +142,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write # Allow comments on PRs
     steps:
       - name: 🏗 Setup repo
diff --git a/preview/README.md b/preview/README.md
index f00f219b..905095f1 100644
--- a/preview/README.md
+++ b/preview/README.md
@@ -130,6 +130,7 @@ jobs:
   preview:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write # Allow comments on PRs
     steps:
       - name: 🏗 Setup repo