diff --git a/.github/workflows/cffconvert.yml b/.github/workflows/cffconvert.yml
index 707a71c4b20fe..c5eb8404bbbf9 100644
--- a/.github/workflows/cffconvert.yml
+++ b/.github/workflows/cffconvert.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - CITATION.cff
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: "validate"
@@ -12,6 +15,8 @@ jobs:
     steps:
       - name: Check out a copy of the repository
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Check whether the citation metadata from CITATION.cff is valid
         uses: citation-file-format/cffconvert-github-action@2.0.0