diff --git a/.github/workflows/ci-remote-image.yaml b/.github/workflows/ci-remote-image.yaml
index 54513c0..6bd9bba 100644
--- a/.github/workflows/ci-remote-image.yaml
+++ b/.github/workflows/ci-remote-image.yaml
@@ -1,6 +1,8 @@
 ---
 name: ci-remote-image
 
+permissions: read-all
+
 on:
   pull_request: