diff --git a/.github/workflows/ash-ci.yml b/.github/workflows/ash-ci.yml
index a61c7a5fa..0fc8e2686 100644
--- a/.github/workflows/ash-ci.yml
+++ b/.github/workflows/ash-ci.yml
@@ -536,6 +536,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: build-test
     permissions:
+      # A job-level block replaces the workflow default; checkout needs this.
+      contents: read
       security-events: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0