diff --git a/.github/workflows/terraform-fmt.yaml b/.github/workflows/terraform-fmt.yaml
index 6dab99a..d5c886b 100644
--- a/.github/workflows/terraform-fmt.yaml
+++ b/.github/workflows/terraform-fmt.yaml
@@ -2,6 +2,8 @@ name: Run terraform fmt
 on:
   pull_request:
 
+permissions: read-all
+
 jobs:
   terraform:
     name: terraform fmt