diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index aa6df8242..7f477bbe0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -19,9 +19,14 @@ on:
     branches: [ master, stable* ]
   schedule:
     - cron: '30 8 * * 6'
+    
+permissions:
+  contents: read
 
 jobs:
   analyze:
+    permissions:
+      security-events: write
     name: Analyze
     runs-on: ubuntu-latest