diff --git a/.github/workflows/test_rust.yml b/.github/workflows/test_rust.yml
index b90e5d6436..ee6b3022f3 100644
--- a/.github/workflows/test_rust.yml
+++ b/.github/workflows/test_rust.yml
@@ -8,6 +8,9 @@ on:
         description: "The SHA key for the commit we want to run over"
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     name: Linux
@@ -26,4 +29,4 @@ jobs:
           bazel: |
             test //rust/upb_kernel:upb_test //rust/cpp_kernel:cpp_test \
               //rust/test/rust_proto_library_unit_test:rust_upb_aspect_test \
-              //rust/upb_kernel:upb_test //src/google/protobuf/compiler/rust/...
\ No newline at end of file
+              //rust/upb_kernel:upb_test //src/google/protobuf/compiler/rust/...