diff --git a/.github/workflows/labeler-cache-retention.yml b/.github/workflows/labeler-cache-retention.yml
index 5df0b6c8056..2367f5acd54 100644
--- a/.github/workflows/labeler-cache-retention.yml
+++ b/.github/workflows/labeler-cache-retention.yml
@@ -20,6 +20,10 @@ on:
         required: true
         default: "ACTIVE"
 
+
+permissions:
+  contents: read
+
 env:
   CACHE_KEY: ${{ inputs.cache_key || 'ACTIVE' }}