diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 62745ec..f445e2d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,9 @@ name: test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 env:
   GOPATH: ${{ github.workspace }}
   WORKSPACE: ${{ github.workspace }}/src/github.com/${{ github.repository }}
@@ -58,6 +61,9 @@ jobs:
 
   lint:
     needs: test
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout