diff --git a/.github/workflows/documentation-build.yml b/.github/workflows/documentation-build.yml
index 4c06f9ab3..419cbfbfb 100644
--- a/.github/workflows/documentation-build.yml
+++ b/.github/workflows/documentation-build.yml
@@ -1,5 +1,8 @@
 name: Generate Docs
 
+permissions:
+  contents: read    # write permission to the destination repo come from 'deploy_key'
+
 on:
   pull_request:
     paths: