diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6b6fe1bf..88f66666 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -11,6 +11,8 @@ on:
 permissions:
   contents: read
   security-events: write
+  actions: read
+  pull-requests: read
 
 jobs:
   analyze:
@@ -22,6 +24,7 @@ jobs:
       contents: read
       security-events: write
       actions: read
+      pull-requests: read
     strategy:
       fail-fast: false
       matrix: