diff --git a/.github/workflows/linkchecker.yaml b/.github/workflows/linkchecker.yaml
index 904684e..302db83 100644
--- a/.github/workflows/linkchecker.yaml
+++ b/.github/workflows/linkchecker.yaml
@@ -5,6 +5,11 @@ on:
   push:
   pull_request:
 
+# lychee uses GITHUB_TOKEN only to raise its github.com rate limit
+# (read-only API calls).
+permissions:
+  contents: read
+
 jobs:
   linkchecker:
     runs-on: ubuntu-22.04