diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index e9ffb05..846307a 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -46,6 +46,7 @@ jobs:
     name: Terraform Plan - ${{ matrix.site }}
     runs-on: self-hosted
     permissions:
+      contents: read
       pull-requests: write
 
     steps: