diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
index 7b8174a1e..40ab4244c 100644
--- a/.github/workflows/nuget.yml
+++ b/.github/workflows/nuget.yml
@@ -13,6 +13,9 @@ on:
       - 'Doc/**'
       - 'appveyor.yml'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   build: