diff --git a/.github/workflows/go-test.yaml b/.github/workflows/go-test.yaml
index 015e60c..40cd663 100644
--- a/.github/workflows/go-test.yaml
+++ b/.github/workflows/go-test.yaml
@@ -31,6 +31,9 @@ jobs:
             coverprofile.out
             gotest.json
   sonar:
+    permissions:
+      contents: read
+      pull_request: read
     runs-on: ubuntu-latest
     needs: tests
     steps: