diff --git a/.github/workflows/pytest-optional.yml b/.github/workflows/pytest-optional.yml
index e2968438e12..29b3dbf8b0f 100644
--- a/.github/workflows/pytest-optional.yml
+++ b/.github/workflows/pytest-optional.yml
@@ -15,6 +15,9 @@ concurrency:
   # Cancel only PR intermediate builds.
   cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
 
+permissions:
+  contents: read
+
 jobs:
   activate-tests:
     name: Check whether we should run tests or not