diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index 1ff7e86..36e8651 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -43,6 +43,8 @@ jobs:
 
   build:
     name: Build Go Binary
+    permissions:
+      contents: read
     runs-on: ${{ matrix.os }}
     needs: auto-tag
     # Always run build, even if auto-tag was skipped (e.g., for tag pushes)