diff --git a/.github/workflows/ci_cmake.yml b/.github/workflows/ci_cmake.yml
index 7b269b52f6..336403c5ab 100644
--- a/.github/workflows/ci_cmake.yml
+++ b/.github/workflows/ci_cmake.yml
@@ -45,6 +45,9 @@ on:
       - '*.yml'
       - 'wxwidgets.props'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.runner }}