diff --git a/.github/workflows/sync-hotfix-translations.yml b/.github/workflows/sync-hotfix-translations.yml
index 5de1718413f..0e49d0a0fb7 100644
--- a/.github/workflows/sync-hotfix-translations.yml
+++ b/.github/workflows/sync-hotfix-translations.yml
@@ -16,6 +16,9 @@ on:
     - cron: "0 10 * * 1"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger-runners:
     name: Trigger sync → ${{ matrix.hotfix_branch }}