diff --git a/.github/workflows/detekt.yml b/.github/workflows/detekt.yml
index 0675c55..d587d01 100644
--- a/.github/workflows/detekt.yml
+++ b/.github/workflows/detekt.yml
@@ -2,6 +2,9 @@
 # It scans on push, PR, scheduled cron, or manual trigger.
 
 name: Scan with Detekt
+permissions:
+  contents: read
+  security-events: write
 
 on:
   push: