diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 51a1a53..7300176 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -17,6 +17,10 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # configure-pages reads site metadata before artifact upload.
+      pages: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4