diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e4830ddd9..dbc163715 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -58,10 +58,16 @@ on:
       - ".github/actions/setup-dependencies/**"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   CodeQL:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6