diff --git a/.github/workflows/test-report.yml b/.github/workflows/test-report.yml
index 200211875..fcc0cb47b 100644
--- a/.github/workflows/test-report.yml
+++ b/.github/workflows/test-report.yml
@@ -4,6 +4,10 @@ on:
     workflows: ['CI']                     # runs after CI workflow
     types:
       - completed
+permissions:
+  contents: read
+  actions: read
+  checks: write
 jobs:
   report:
     runs-on: ubuntu-latest