diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 7c0b9076..ee282ebb 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -10,6 +10,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs when a new commit lands on the same PR branch.
 # On main (push events), each commit gets a unique group so rapid merges
 # don't cancel each other's CI runs.