diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index e03ee6041..81272d0f0 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -2,6 +2,8 @@ name: Publish to WinGet
 on:
   release:
     types: [released]
+permissions:
+  contents: read
 jobs:
   publish:
     runs-on: windows-latest