diff --git a/.github/workflows/arc-release-runners.yaml b/.github/workflows/arc-release-runners.yaml
index a30fbe53..54bd9772 100644
--- a/.github/workflows/arc-release-runners.yaml
+++ b/.github/workflows/arc-release-runners.yaml
@@ -1,4 +1,6 @@
 name: Release ARC Runner Images
+permissions:
+  contents: read
 
 # Revert to https://github.com/actions-runner-controller/releases#releases
 # for details on why we use this approach