diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 03dba69..ba2096d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,6 +33,12 @@ jobs:
         - os: ubuntu
           arch: x86
     permissions:
+      # required for all workflows
+      security-events: write
+      # required to fetch internal or private CodeQL packs
+      packages: read
+      # only required for workflows in private repositories
+      actions: read
       contents: read
     name: Build
     runs-on: ${{ matrix.os }}-latest