diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index eba36d2d..28c22f2e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -35,4 +35,9 @@ jobs:
 
   build-and-test:
     uses: cap-java/cds-feature-attachments/.github/workflows/pipeline.yml@main
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
     secrets: inherit