diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index fabee95..e32e095 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -13,6 +13,9 @@ name: Bench
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   bench:
     runs-on: [self-hosted, bench]