diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68e7d085f..70a5fa159 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,9 @@ on: # rebuild any PRs and main branch changes
   push:
     branches:
       - main
-      - 'releases/*'
+
+permissions:
+  contents: read
 
 jobs:
   build: # make sure build/ci work properly