diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fee0b34cb..58ca87573 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,8 +9,8 @@
 name: CodeQL
 
 permissions:
-  security-events: write    # needed to post results
   contents: read
+  security-events: write    # needed to post results
 
 on:
   push: