diff --git a/.github/workflows/submit.yml b/.github/workflows/submit.yml
index 260176a65..4bc3ef514 100644
--- a/.github/workflows/submit.yml
+++ b/.github/workflows/submit.yml
@@ -2,6 +2,9 @@ name: "submit"
 on: 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build: 
     runs-on: ubuntu-latest