diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b5e3f142c..b61db0784 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,10 @@
 
 name: Continuous Integration
 
+# No need for more than read permission
+permissions:
+  contents: read
+
 on:
   # Triggers the workflow on push or pull request events but only for this git branch
   push:
@@ -57,9 +61,6 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   # NOTE: We rely on containers for everything to get version consistency
   python3-latest: