diff --git a/.github/workflows/validate-pull-request-presubmit.yaml b/.github/workflows/validate-pull-request-presubmit.yaml
index 86a0c283..1074869d 100644
--- a/.github/workflows/validate-pull-request-presubmit.yaml
+++ b/.github/workflows/validate-pull-request-presubmit.yaml
@@ -1,7 +1,8 @@
 name: Validate pull request with presubmit before putting into queue
+permissions:
+  contents: read
 on:
   pull_request:
-jobs:
   validate:
     runs-on: ubuntu-latest
     env: