diff --git a/.github/workflows/pr-metadata-check.yml b/.github/workflows/pr-metadata-check.yml
index 6f60ec45bf4..9f06a0bd979 100644
--- a/.github/workflows/pr-metadata-check.yml
+++ b/.github/workflows/pr-metadata-check.yml
@@ -17,6 +17,10 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   check-metadata:
     name: PR has assignee, labels, and milestone