diff --git a/.github/workflows/trivy-periodic.yaml b/.github/workflows/trivy-periodic.yaml
index 56a1d2864..4732ed4c5 100644
--- a/.github/workflows/trivy-periodic.yaml
+++ b/.github/workflows/trivy-periodic.yaml
@@ -6,10 +6,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   trivy-scan-vulns:
     permissions:
-      contents: read
       security-events: write
       actions: read
     runs-on: ubuntu-24.04