diff --git a/.github/workflows/openwrt-ci.yml b/.github/workflows/openwrt-ci.yml
index 8677e5250..00a4d6000 100644
--- a/.github/workflows/openwrt-ci.yml
+++ b/.github/workflows/openwrt-ci.yml
@@ -12,11 +12,17 @@ on:
     - cron: 0 20 * * *
   release:
     types: [published]
+    
+permissions:
+  contents: read
 
 jobs:
 
   build_openwrt:
 
+    permissions:
+      contents: write # for release creation
+
     name: Build OpenWrt firmware
 
     runs-on: ubuntu-latest