diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 65bfa1ca8..34c45d6be 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -107,6 +107,7 @@ jobs:
         run: make release
 
   clang-format:
+    permissions: read-all
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
     name: "Code Style (Arch)"
     runs-on: ubuntu-latest