diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ca14abe5..94f741ab 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -24,6 +24,9 @@ on: [workflow_dispatch, push]
 env:
   PKG_NAME: "terraform-provider-boundary"
 
+permissions:
+  contents: read
+
 jobs:
   # Detects the Go version to use for builds.
   get-go-version: