diff --git a/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml b/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml
index a33df0b5..c9c4834d 100644
--- a/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml
+++ b/.github/workflows/ci-dotnet-semantickernel-sampleagent.yml
@@ -1,4 +1,6 @@
 name: CI - Build .NET Semantic Kernel Sample Agent
+permissions:
+  contents: read
 
 on:
   push: