diff --git a/.github/workflows/engine-benchmarks.yml b/.github/workflows/engine-benchmarks.yml
index 9a2e7533..f0f3f91a 100644
--- a/.github/workflows/engine-benchmarks.yml
+++ b/.github/workflows/engine-benchmarks.yml
@@ -34,6 +34,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Set contents permission to read, all others are set to none automatically
+permissions:
+  contents: read
+
 jobs:
   smoke-ubuntu-latest:
     # Smoke pack on the default GitHub runner. Goal: prove the harness +