diff --git a/README.md b/README.md
index a4b1035..d18e150 100644
--- a/README.md
+++ b/README.md
@@ -337,7 +337,8 @@ jobs:
     runs-on: ubuntu-latest
     # Required permissions
     permissions:
-      pull-requests: read
+      contents: read      # required by actions/checkout
+      pull-requests: read # required by dorny/paths-filter
     steps:
     - uses: actions/checkout@v6
     - uses: dorny/paths-filter@v4