diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b9441236bc..6e4815c0b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,8 @@ on:
     - cron: '44 4 * * *' # At 4:44 UTC every day.
 
 permissions:
-  contents: write
+  contents: read
+  pull-requests: write
 
 defaults:
   run: