diff --git a/.github/workflows/pull_from_upstream.yml b/.github/workflows/pull_from_upstream.yml
index a143de35..c7cf7aa8 100644
--- a/.github/workflows/pull_from_upstream.yml
+++ b/.github/workflows/pull_from_upstream.yml
@@ -6,6 +6,8 @@ on:
     # Run every Saturday at 0900 UTC
     - cron: '0 9 * * 6'
 
+permissions: {}
+
 jobs:
   sync-workflows:
     if: github.repository != 'OpenAstronomy/github-actions-workflows'