diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml
index 3e530f3..9e0e7cd 100644
--- a/.github/workflows/lint-php.yml
+++ b/.github/workflows/lint-php.yml
@@ -52,6 +52,8 @@ permissions: {}
 jobs:
   composer-normalize:
     if: ${{ inputs.composer-normalize }}
+    permissions:
+      contents: read
     runs-on: ubuntu-26.04
     steps:
       - parallel: