diff --git a/README.md b/README.md
index b5e0f4cf..ddc455f5 100644
--- a/README.md
+++ b/README.md
@@ -322,7 +322,8 @@ jobs:
     runs-on: ubuntu-latest
     # Required permissions
     permissions:
-      pull-requests: read
+      contents: read      # required by actions/checkout
+      pull-requests: read # required by dorny/paths-filter
     steps:
     - uses: actions/checkout@v4
     - uses: dorny/paths-filter@v3