diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 651cefc..682fcd1 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -22,3 +22,7 @@ jobs:
 
       - name: Clean up
         run: rm -rf ~/.ssh
+
+    permissions:
+      contents: read
+      pull-requests: write