diff --git a/.github/workflows/msvc-static-build.yml b/.github/workflows/msvc-static-build.yml
index 81fb9c45a..461752279 100644
--- a/.github/workflows/msvc-static-build.yml
+++ b/.github/workflows/msvc-static-build.yml
@@ -1,5 +1,8 @@
 name: MSVC Static Build
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+  
 on:
   push:
   pull_request: